<![CDATA[Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data]]>Researchers at Imperva have demonstrated a working proof of concept that chains crafted Brotli data to remote code execution on a standard, unmodified Node.js build. Dubbed Node2Shell, the exploit ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64, without a debugger or any custom build, by feeding malicious input to the bundled Brotli decoder. The flaw is tracked as CVE-2026-111497.

Key points from the disclosure:

  • The target was the official Node.js 24.22.0 Linux arm64 image, not a debug or custom build.
  • The attack vector is crafted Brotli data processed by the decoder shipped with Node.js.
  • Successful exploitation results in remote code execution under the application's context.
  • Node.js has disclosed the vulnerability; the researchers' demonstration shows the issue is practically exploitable rather than theoretical.

Because the bundled Brotli decoder is reachable wherever applications decompress untrusted Brotli content, teams running affected Node.js versions should review their exposure and apply the vendor's fix as soon as possible. Until patched builds are deployed, avoid passing untrusted Brotli data to the decoder and treat any service that does so as potentially at risk.

Source: info@thehackernews.com (The Hacker News)

Does your organization process untrusted Brotli data in Node.js services, and if so, how are you handling the patch?

]]>https://xploitlk.com/topic/775/researchers-demonstrate-node2shell-rce-exploit-on-node.js-build-using-crafted-brotli-dataRSS for NodeTue, 27 Oct 2026 07:22:50 GMTSat, 24 Oct 2026 12:30:17 GMT60