cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Researchers Demonstrate Node2Shell RCE on Official Node.js Build via Crafted Brotli Data

· Original article ↗

Summary

Imperva demonstrated code execution via crafted Brotli data on Node.js 24.22.0 for Linux arm64. The flaw affects the 22.x, 24.x and 26.x lines; Node.js released fixes, and no in-the-wild exploitation had been reported as of October 22.

Key points

  • Imperva's Node2Shell proof of concept achieved code execution on the official Node.js 24.22.0 Linux arm64 image, without a debugger or custom build; execution took several attempts.
  • The flaw, CVE-2026-111497, is in Node.js's bundled Brotli decoder and affects the 22.x, 24.x and 26.x lines.
  • Imperva reproduced the issue when decoding Brotli request bodies through tested Express 5 and body-parser versions, and when Node.js fetch() decoded Brotli responses.
  • The decoder continued in an invalid state after encountering an impossible Brotli stream block change; a memory-sanitizer test showed an out-of-bounds write.
  • Node.js's fix makes the decoder stop with a format error. The same data was rejected on fixed release 24.22.1.
  • Update Node.js and artifacts bundling its binary. End-of-life 20.x and earlier lines will not receive the fix; the advisory lists no runtime workaround.
  • No in-the-wild exploitation had been reported as of October 22. Imperva and Vercel added WAF rules, but Vercel's rules do not cover Brotli responses fetched from other servers and do not replace updating.

Article Details

Vulnerability Types
  • Out-of-bounds write
  • Remote code execution
Affected Versions
  • Node.js 22.x
  • Node.js 24.x
  • Node.js 26.x
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • Limit untrusted Brotli traffic on affected paths where practical.
  • Use web application firewall rules to block the demonstrated attacks; the reported rules do not cover Brotli responses fetched from other servers.

CVE

CVE-2026-111497arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw and released fixes on October 21, and applications that decode untrusted

Vendors

ImpervaMalicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.VercelVercel, which runs Node.js for its customers, said it added rules on October 21 that block the attack in inbound requests. The rules do not cover Brotli responses an application fetches from other servers, and do not

Products

Node.jsMalicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.

Related Articles