Security Update for Lime CRM Email Integration - EmailEngine Brotli Vulnerability (Node2Shell)

EmailEngine, the component that connects Lime CRM Email Integration to your mail server, runs on a version of Node.js with a security flaw. In some setups, an attacker could exploit it to run code on the server where EmailEngine is installed. Upgrade EmailEngine to version 2.87.2 using the script below.

• Severity: Medium
• Status: Patch available
• Evidence of exploitation: None observed against Lime CRM
• Environment: On-premise

• On-premise installations of EmailEngine 2.86.0 or earlier. From version 2026.1, the Lime CRM on-premise installer installs EmailEngine together with Lime CRM, even if Email Integration is not used.
• EmailEngine in Lime Cloud. All cloud environments are already updated.

The current Lime CRM on-premise installers include EmailEngine 2.87.2, so new installations are not affected.

EmailEngine is installed if the server has a Windows service named lime-emailengine. If the service is stopped, the flaw cannot be exploited, but upgrade anyway so that EmailEngine is fixed if it is started later. Lime CRM installations without EmailEngine are not affected.

The flaw is hard to exploit. An attacker would first have to break into your company network, your Lime CRM server, or a service like Microsoft or Google. If they managed that, they could take over EmailEngine, the email accounts connected to Lime CRM, and the server EmailEngine runs on, which is usually also your Lime CRM server.

NB! Receiving an email cannot trigger the flaw, whatever the email contains.

The flaw is in the Brotli decoder bundled with Node.js and is tracked as CVE-2026-111497, also known as Node2Shell. It was fixed in EmailEngine 2.87.0. Exploit attempts against Node.js have been seen in the wild, but there is no evidence that this has been exploited against Lime CRM.

1. On the server where EmailEngine runs, open http://127.0.0.1:3018 in a browser.
2. The version is shown at the bottom of the page.

If the version is 2.86.0 or earlier, upgrade EmailEngine. If the page doesn't open, EmailEngine is probably not running, for example because you don't use Email Integration. Run the script anyway. It makes no changes if 2.87.2 is already installed.

• Administrator access to the server where EmailEngine runs.
• Internet access from the server to github.com, or see Server without internet access.
• If you use Email Integration: a few minutes of downtime. Email sending and receiving in Lime CRM pauses while EmailEngine restarts. Emails that arrive in the meantime are imported afterwards.

1. Download the upgrade script ZIP file from here.
2. Extract the ZIP file to a folder on the EmailEngine server, for example C:\Temp\ee-upgrade\.
3. Right-click upgrade-emailengine.cmd and select “Run as administrator”.
4. Verify that the window ends with one of these:
   • “EmailEngine v2.87.2 is running and healthy”
   • “EmailEngine is stopped, so it was updated without starting it”, if you don't use Email Integration
5. If you use Email Integration:
   • Check that version 2.87.2 is running, as described in Check Your EmailEngine Version.
   • In Lime Admin, check that the email accounts still show as connected after a minute or two.

If the new version doesn't start, the script automatically rolls back to the previous one. Contact Support and attach upgrade-emailengine.log from the script folder.

Download emailengine.exe from the EmailEngine v2.87.2 release on another machine and copy it to the script folder on the server. Then open PowerShell as administrator and run:

cd C:\Temp\ee-upgrade
.\upgrade-emailengine.cmd -ExeFile C:\Temp\ee-upgrade\emailengine.exe

1. Upgrade to EmailEngine 2.87.2 as soon as possible if your installation is affected.
2. Contact Support if you need help.