New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data

Researchers has demonstrated Node2Shell, a working exploit that lets an attacker run code inside a Node.js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory flaw in the Brotli decoder bundled with Node.js.

The Node.js security advisory, published on October 21, 2026, confirms that the flaw can allow remote code execution and affects the 22.x, 24.x, and 26.x release lines. Fixes are available across all three branches.

New Node2Shell Node.js RCE Exploit

According to the supplied Imperva research, its standalone proof of concept worked against the official Node.js 24.22.0 Linux arm64 image without a debugger or modified binary. The code delivered with the compressed data created a marker file that the test application was not instructed to produce.

Execution required multiple attempts in the tested setup. The results establish exploitation on that specific build and application configuration, not reliable execution across every Node.js platform.

The flaw appears when the decoder encounters an invalid transition between block types within a Brotli stream. Instead of rejecting the broken stream, the vulnerable code treats the condition as a need for more input and continues processing with an invalid internal state.

Imperva’s separate memory-sanitizer test showed that this behavior could write beyond an intended buffer. That out-of-bounds write provides the underlying memory corruption behind the demonstrated code execution.

The patched decoder returns a format error for the invalid transition. Node.js 24.22.1 release notes confirm the inclusion of the Brotli security fix. In Imperva’s application tests, that release rejected the same malicious inputs without creating the marker file.

Imperva tested compressed HTTP responses consumed through Node.js’s built-in fetch() function and incoming request bodies decoded by configured Express and body-parser middleware.

The tested setups included Express 5.0.0 with body-parser 2.0.1, Express 5.3.0 with body-parser 2.3.0, and standalone body-parser 2.0.0. Both raw() and json() parser paths allowed execution in the tested vulnerable environments.

These packages provide routes into the affected decoder rather than containing the underlying flaw. A bare Node.js HTTP server does not automatically decompress incoming Brotli bodies.

Cybersecurity News previously covered the affected branches in its report on Node.js security updates. Its October 21 security roundup also highlights the need to rebuild container images with the updated runtime.

Administrators should deploy Node.js 22.23.4, 24.22.1, or 26.12.1, or newer fixed versions in those branches. The official advisory lists these releases as the security updates addressing the flaw.

Teams should check the actual Node.js binary inside deployed containers and hosts, then review where services decode untrusted compressed requests or responses.

Imperva says it added WAF rules covering reproduced exploitation attempts. Those controls provide temporary protection, but replacing the vulnerable runtime remains essential. Decoder errors and unexpected process exits may support investigation, but neither alone proves successful exploitation.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data appeared first on Cyber Security News.