Node2Shell: Imperva Demonstrates RCE on Official Node.js Build Using Crafted Brotli Data

Overview

Researchers at Imperva have demonstrated Node2Shell, a proof of concept in which malicious Brotli-compressed data causes an official Node.js build to run attacker-supplied code. The demo ran on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build. The underlying flaw is tracked as CVE-2026-111497, in the Brotli decoder that Node.js bundles.

Technical Summary

A Brotli stream announces block types as it is decoded. Imperva's input triggers a block change that the stream's structure makes impossible. The vulnerable decoder treats this as a request for more input and continues decoding in an invalid state. A memory-sanitizer test showed this leads to an out-of-bounds write past an intended buffer.

Exploitation was not reliable and took several attempts in Imperva's setup. An earlier public proof of concept achieved code execution only on a deliberately weakened build; on a standard build it produced a crash and a limited memory read.

Attack Paths

• Reading a Brotli-compressed response through Node.js's built-in fetch().
• Decoding a Brotli-compressed request body. Express 5 body parsers such as express.json() and express.raw() decode Brotli bodies on routes where they are applied. Imperva tested Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0.
• A plain Node.js HTTP server does not decode request bodies by itself, so it needs such middleware or an explicit decode call.

Affected Versions

Only Node.js 24.22.0 on Linux arm64 was tested. Other architectures and the 22.x and 26.x lines were not.

Fix and Mitigation

Node.js released patches on October 21, 2026, importing an upstream Brotli fix. The decoder now stops with a format error at the invalid point; 24.22.1 rejects the same data.

1. Update to a patched Node.js release, including container images and any artifact that bundles a Node binary.
2. Move off end-of-life lines, which will not be fixed.
3. Where practical, limit untrusted Brotli traffic on affected paths. No in-runtime workaround is listed; only the update removes the flaw.
4. Imperva WAF rules and Vercel's inbound-request rules (added October 21) can block attacks. Vercel's rules do not cover Brotli responses fetched from other servers.

As of October 22, no in-the-wild exploitation had been reported.

Source

• The Hacker News — Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data