51% attack, miners, nodes or both
A 51% attack involves just 51% of the hashrate, no nodes are involved.
With a majority of the hashrate, miners can construct a new branch in the chain that overtakes the chain that was previously accepted.
It has to be an otherwise valid chain, as otherwise nodes would reject it. The attack doesn't let the 51% attackers make the network accept any invalid transactions - it can just roll them back.