Imperva shows Node2Shell RCE on stock Node.js via Brotli
Crafted Brotli data ran code on Node.js 24.22.0 Linux arm64; 24.22.1 rejected it, and no wild attacks were reported.
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #node2shell
Brotli decoder flaw CVE-2026-111497 can leak memory or run code
Versions 1.0.3 through 1.2.0 are affected; fixed releases include Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1.
3