Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
-
Researchers at Imperva have demonstrated a working proof of concept that chains crafted Brotli data to remote code execution on a standard, unmodified Node.js build. Dubbed Node2Shell, the exploit ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64, without a debugger or any custom build, by feeding malicious input to the bundled Brotli decoder. The flaw is tracked as CVE-2026-111497.
Key points from the disclosure:
- The target was the official Node.js 24.22.0 Linux arm64 image, not a debug or custom build.
- The attack vector is crafted Brotli data processed by the decoder shipped with Node.js.
- Successful exploitation results in remote code execution under the application's context.
- Node.js has disclosed the vulnerability; the researchers' demonstration shows the issue is practically exploitable rather than theoretical.
Because the bundled Brotli decoder is reachable wherever applications decompress untrusted Brotli content, teams running affected Node.js versions should review their exposure and apply the vendor's fix as soon as possible. Until patched builds are deployed, avoid passing untrusted Brotli data to the decoder and treat any service that does so as potentially at risk.
Source: [email protected] (The Hacker News)
Does your organization process untrusted Brotli data in Node.js services, and if so, how are you handling the patch?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login