Researchers have demonstrated “Node2Shell,” a working exploit that allows an attacker to execute code inside a Node.js application by supplying specially crafted Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory vulnerability in the Brotli decoder that is bundled with Node.js.
The Node.js security advisory published on October 21, 2026, confirms the flaw can enable remote code execution and affects the 22.x, 24.x, and 26.x release lines. Patches are available for all three branches.
New Node2Shell Node.js RCE Exploit
Imperva’s research shows a standalone proof-of-concept that succeeded against the official Node.js 24.22.0 Linux arm64 image without using a debugger or a modified binary. The exploit code delivered via the compressed input created a marker file that the test application was not intended to produce.
Execution in the tested environment required multiple attempts. That demonstrates exploitation against that particular Node.js build and application configuration, but does not mean the exploit produces reliable execution across every Node.js deployment.
The bug occurs when the decoder encounters an invalid transition between block types inside a Brotli stream. Instead of rejecting the malformed stream, the vulnerable decoder treats the condition as if more input is required and continues processing with an invalid internal state.
Imperva’s memory-sanitizer tests indicate this behavior can lead to an out-of-bounds write. That memory corruption is the underlying issue that made the demonstrated code execution possible.
The patched decoder now returns a format error for the invalid transition. Node.js 24.22.1 release notes confirm the Brotli security fix; in Imperva’s tests that release rejected the same malicious inputs and did not create the marker file.
Imperva tested both compressed HTTP responses consumed by Node.js’s built-in fetch() and incoming request bodies decoded by Express with body-parser middleware.
The test configurations included Express 5.0.0 with body-parser 2.0.1, Express 5.3.0 with body-parser 2.3.0, and standalone body-parser 2.0.0. In the vulnerable environments, both the raw() and json() parser paths allowed the exploit to run.
These middleware packages provide an entry point to the affected decoder but do not contain the underlying flaw. A plain Node.js HTTP server does not automatically decompress incoming Brotli bodies.
Cybersecurity News previously covered the affected branches in its report on Node.js security updates and noted the need to rebuild container images with the updated runtime.
Administrators are advised to upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1 — or to newer fixed releases in those branches. The official advisory lists these releases as the security updates addressing CVE-2026-111497.
Teams should inspect the actual Node.js binary inside deployed containers and hosts and review where services decode untrusted compressed requests or responses.
Imperva says it has added WAF rules to detect reproduced exploitation attempts. Those rules can provide temporary mitigation, but replacing the vulnerable runtime remains essential. Decoder error messages and unexpected process exits may assist investigation, but neither is definitive proof of successful exploitation.
Update defenses against new malware as soon as it appears. Integrate threat-intelligence feeds with data from 16K SOCs.
