Node2Shell PoC runs code through Node.js Brotli decoder flaw
Original title: New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data
Imperva’s proof of concept worked on Node.js 24.22.0; fixed builds are 22.23.4, 24.22.1, and 26.12.1.
Researchers demonstrated Node2Shell, a proof of concept for CVE-2026-111497, a high-severity memory flaw in the Brotli decoder bundled with Node.js. A Node.js advisory published October 21 says the bug can allow remote code execution on the 22.x, 24.x, and 26.x lines. Imperva’s standalone PoC created a marker file on the official Node.js 24.22.0 Linux arm64 image after multiple attempts. Patched releases reject the invalid Brotli transition that caused the out-of-bounds write.
Unconfirmed: The PoC worked on one Node.js 24.22.0 Linux arm64 setup after multiple attempts, not across every platform.
- An invalid block-type transition leaves the decoder in a bad state.
- Express and body-parser routes reached the decoder; they do not contain the flaw.
- A bare Node.js HTTP server does not auto-decompress Brotli request bodies.
- Node.js 24.22.1 rejected the same inputs without creating the marker file.
- Imperva says it added WAF rules for reproduced attempts.
Impact: Remote code execution via crafted Brotli-compressed data
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | 22.x, 24.x, and 26.x | 22.23.4, 24.22.1, or 26.12.1 |
- 1.Deploy Node.js 22.23.4, 24.22.1, or 26.12.1, or a newer fixed build in those branches.
- 2.Check the Node.js binary in containers and hosts, then rebuild images.
- 3.Review services that decode untrusted compressed requests or responses.
- CVEs
- CVE-2026-111497
- Products
- Node.jsExpressbody-parser
- Malware
- Node2Shell
- Organizations
- Imperva
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×15 |
From the original article
2 min read at cybersecuritynews.com
Researchers has demonstrated Node2Shell, a working exploit that lets an attacker run code inside a Node. js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory flaw in the Brotli decoder bundled with Node.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.