Synology SA-26:15: Node2Shell vulnerability – what you need to know

Synology has published security advisory SA-26:15 concerning a vulnerability known as Node2Shell. The good news: most Synology products are not affected. However, Synology Chat Client users should take action. Read on to find out whether your systems need attention.

What is the Node2Shell vulnerability?

The vulnerability stems from a buffer overflow flaw in the Brotli decoder, a data compression library used in various software. According to Synology, this affects Google Brotli versions 1.0.3 through 1.2.0 across all platforms. A remote attacker without authentication could exploit this flaw to corrupt memory, leak sensitive data, cause a denial of service, or potentially run arbitrary code on a system using a specially crafted compressed stream.

Synology rates this issue as having a critical severity score of 9.8 on the CVSS3 scale, though the advisory itself is marked as moderate. The attack requires no user interaction or special privileges, making it a genuine concern for exposed systems.

Which Synology products are affected?

Synology has assessed a wide range of its own products and packages for this vulnerability. The findings are clear:

• Synology Chat Client is affected (fix status: ongoing)
• Synology Application Service is not affected
• Synology Calendar is not affected
• Synology Chat Server is not affected
• Synology Contacts is not affected
• Synology Drive Server is not affected
• Synology MailPlus is not affected
• Synology Meet is not affected
• Synology Office is not affected
• Synology Photos is not affected
• VPN Plus Server is not affected
• Note Station Client is not affected

If you use Synology Chat Client, you should check your version and watch for updates. Synology has not yet released a fixed version, so the status remains ongoing as of the advisory's last update on 30 October 2026.

What should you do right now?

If you run Synology Chat Client, take these steps:

• Check which version of Synology Chat Client you are running
• Monitor Synology's security page for a patched release
• Be ready to update as soon as a fixed version becomes available
• Synology has not listed any mitigations, so updates are the primary defence

If you use other Synology products and services—such as Drive Server, Photos, Calendar, or your NAS running DSM—you are not at risk from this particular vulnerability. No action is needed for those systems.

Concerned about your Synology setup?

Ryzen's managed services team can check your Synology systems for current versions, apply security updates, and keep your NAS and collaboration platforms running safely. We're an authorised Synology partner in Malaysia with the expertise to handle everything from single DiskStations to multi-site estates. Get in touch with us if you'd like us to review your systems or manage future updates for you.

Source: Synology-SA-26:15 Node2Shell, published by Synology on 29 October 2026.

Products for this job

Hardware and licences are supplied through our sister shop PrinterBullet. Prices are today's.

Synology M2D18 Dual M.2 SSD Adapter Card RM 539.00 Synology Surveillance Device License Pack 4 RM 1,089.00 Synology E10G30-T1 Single port 10 Gigabit Base-T PCIe 3.0 x4 Ethernet... RM 699.00 Synology E25G30-F2 dual-port 25GbE SFP28 network card RM 1,879.00

Frequently asked questions

Is my Synology NAS affected by Node2Shell?

No. Synology NAS devices running DSM are not affected by this vulnerability. Only Synology Chat Client has been flagged as vulnerable.

When will Synology release a fix for Chat Client?

Synology has not yet released a patched version. The advisory status is 'ongoing'. Monitor Synology's security page regularly for updates.

What platforms does Node2Shell affect?

The underlying Brotli decoder flaw affects all platforms. However, Synology products other than Chat Client are not vulnerable to exploitation of this specific flaw.