Imperva shows Node2Shell RCE on stock Node.js via Brotli
Original title: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Crafted Brotli data ran code on Node.js 24.22.0 Linux arm64; 24.22.1 rejected it, and no wild attacks were reported.
Imperva demonstrated Node2Shell, a proof of concept that feeds crafted Brotli data to Node.js's bundled decoder and runs attacker-supplied code. The test succeeded on the official Node.js 24.22.0 Linux arm64 image after several tries, through request-body and response paths, including Express body parsers. Node.js released fixes on October 21; the same data was rejected on 24.22.1. No in-the-wild exploitation was reported as of October 22.
Unconfirmed: Code execution was unreliable and shown only on one Linux arm64 build; other architectures and the 22.x and 26.x lines were not tested.
- The flaw is CVE-2026-111497 in the bundled Brotli decoder.
- Imperva tested Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0.
- Lines 22.x, 24.x, and 26.x are affected; 22.x and 26.x were not tested.
- Node.js 20.x and earlier are end of life and will not get the fix.
Impact: remote code execution by decoding untrusted Brotli data
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | 22.x, 24.x, and 26.x; demonstrated on 24.22.0 | 24.22.1 |
- 1.Update Node.js, including container images that bundle a Node binary.
- 2.Move end-of-life 20.x and earlier lines to a supported release.
- 3.Limit untrusted Brotli traffic where an immediate update is not possible.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×15 |
From the original article
3 min read at thehackernews.com
Malicious Brotli data can make an application on an official build of Node. js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.