Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Security researchers at Imperva have published a proof-of-concept called "Node2Shell" showing that specially crafted Brotli data can trigger remote code execution on an unmodified official Node.js 24.22.0 build for Linux arm64, exploiting the bundled Brotli decoder (CVE-2026-111497). Unlike an earlier public PoC that only achieved code execution on a deliberately weakened test build and merely crashed or leaked limited memory on a standard build, Imperva's exploit worked—though inconsistently, requiring several attempts—against a genuine production-style setup. The flaw stems from the decoder mishandling an impossible block-type transition in the Brotli stream, causing it to keep processing invalid data and ultimately write past a buffer boundary; applications are exposed either through Node's built-in fetch() reading compressed responses or through middleware such as Express 5's body parsers (tested on 5.0.0–5.3.0 with body-parser 2.0.0–2.3.0) decoding compressed request bodies. Node.js shipped a fix on October 21 by adopting an upstream Brotli patch, and version 24.22.1 correctly rejects the malicious input; affected lines include 22.x, 24.x, and 26.x, with end-of-life 20.x and earlier never receiving a fix. No in-the-wild exploitation has been reported as of October 22, but since there is no in-runtime workaround, organizations should update Node binaries everywhere—including in containers—and Vercel has already deployed blocking rules for inbound requests as a stopgap.