Imperva demos "Node2Shell" RCE on stock Node.js build via Brotli decoder flaw

Past-week coverage · Original source published 2026-10-23.

Security researchers at Imperva say they got an official Node.js build to run attacker-supplied code by feeding it crafted Brotli-compressed data. They named the proof of concept "Node2Shell."

According to The Hacker News, the demonstration ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger and no custom build. The entry point was the Brotli decoder bundled with Node.js, tracked as CVE-2026-111497.

The vulnerability sits in the Brotli decoder source file c/dec/decode.c. Per the CVE description, a buffer overflow in Google Brotli versions 1.0.3 through 1.2.0 on all platforms lets a remote, unauthenticated attacker corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Google's CNA record rates it 9.2 critical under CVSS 4.0.

The same description says users should move Brotli libraries or binaries in that range to 1.0.10, 1.1.1 or 1.2.1. Node.js published a security release note covering the decoder issue.

Why it matters: Brotli is widely used for HTTP compression, so a decoder bug can sit behind ordinary request handling rather than an unusual feature. A proof of concept on a stock image is a reminder to check which Brotli version your runtime ships, including bundled copies inside language runtimes and container images, and to apply the vendor's fixed release rather than assuming the upstream library is patched.

CVE references

CVE-2026-111497