Security researchers at Imperva said they ran attacker-supplied code on an official Node.js 24.22.0 image for Linux arm64 by sending crafted Brotli data to the runtime's bundled decoder, The Hacker News reported Friday¹. The demonstration, which Imperva calls Node2Shell, used no debugger and no custom build, according to that account¹.

Node.js disclosed the decoder flaw as CVE-2026-111497 and released patched versions on Oct. 21¹. Imperva said the same payload was rejected on 24.22.1 and did not run code¹. Applications that decompress untrusted Brotli input should move to a fixed release, the report said¹.

The Hacker News said the result goes past an earlier public proof of concept that executed code only on a deliberately weakened test build¹. On a standard build, that earlier author reported a crash and a limited read of process memory, not code execution, according to the article¹.

Imperva's own test did not succeed on every attempt, and code execution took several tries in the Linux arm64 setup it used¹. The company did not test other architectures or the 22.x and 26.x lines, the article said, though the bundled decoder is present on those supported lines as well¹. No exploitation in the wild had been reported as of Oct. 22¹.

A service can hit the decoder when Node's built-in fetch() reads a Brotli-compressed response, or when middleware decodes a Brotli request body¹. Express 5 body parsers such as express.json() decode Brotli on applied routes; a plain Node HTTP server does not decode such a body merely by receiving it¹. Imperva said it reproduced execution on both the request-body and response paths using pinned Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0, without testing every release in between¹.

The researchers described the bug as the decoder treating an impossible block-type change in a Brotli stream as a request for more input and continuing in an invalid state, which a sanitizer test showed could write past a buffer¹. Node.js imported an upstream Brotli patch that stops with a format error at that point¹. End-of-life 20.x and earlier do not get the fix¹.

The advisory listed no in-runtime workaround¹. Imperva suggested limiting untrusted Brotli on affected paths where that is practical and said only the update removes the flaw¹. Vercel said it added inbound-request rules on Oct. 21 that block the attack it described; those rules do not cover Brotli responses an app fetches from other servers and do not replace updating, according to The Hacker News¹.

An earlier The Hacker News report on the Oct. 21 releases said Node.js issued 22.23.4, 24.22.1 and 26.12.1 to fix 10 flaws across the supported 22.x, 24.x and 26.x lines. CVE-2026-111497 is rated high; the project describes it as an out-of-bounds write that can allow remote code execution. The same account said a public proof of concept posted Oct. 22 ran code only on a deliberately weakened test build.

That earlier report listed three other high-severity fixes: two TLS hostname-check bypasses when an IP is written in unusual form (CVE-2026-106069 and CVE-2026-105483) and a dns.resolve truncation at an embedded null byte (CVE-2026-105482). Node.js also added a built-in block on eight compromised eMudhra intermediate CA keys and updated bundled undici, c-ares, OpenSSL on 22.x and 24.x, and SQLite on 22.x, according to that article. Brotli 1.2.1, 1.1.1 and 1.0.10 shipped the decoder change the same day, so other software that bundles Brotli may need the same update.

Sources

1. The Hacker NewsResearchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli DataOct 23, 3:50 AM

Read the original at The Hacker News ↗