Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

The vulnerability, identified as CVE-2026-111497, resides in the Brotli decoder bundled with Node.js. Imperva researchers demonstrated their "Node2Shell" proof of concept successfully running attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64 without requiring a debugger or custom build.

Node.js disclosed the flaw and released fixes on October 21. The company confirmed that applications decoding untrusted Brotli data should update immediately. Imperva's testing showed that while their exploit worked on the vulnerable version, the same crafted data was rejected in the patched release 24.22.1, preventing any code execution.

Affected Applications

The vulnerability extends beyond the specific build Imperva tested, affecting all applications running on Node.js versions 22.x, 24.x, and 26.x. The Brotli decoder can be reached through two paths: when reading a Brotli-compressed response via Node.js's built-in fetch(), or when middleware decodes a Brotli-compressed request body.