Cybersecurity researchers have unveiled a critical exploit named Node2Shell, which enables attackers to execute malicious code in Node.js applications via carefully crafted Brotli-compressed data. This vulnerability is linked to CVE-2026-111497, a significant memory flaw in the Brotli decoder that comes with Node.js.
Details of the Node.js Vulnerability
The Node.js security advisory, issued on October 21, 2026, highlights the potential for remote code execution due to this flaw, impacting Node.js versions 22.x, 24.x, and 26.x. Security patches have been released to address these issues across all affected versions.
Imperva’s research demonstrated a proof-of-concept exploit on the Node.js 24.22.0 Linux arm64 image. The exploit does not require a debugger or modified binary, and it was able to create a marker file in a test application, indicating successful execution of the malicious code.
Technical Insight into the Exploit
The vulnerability arises when the Brotli decoder improperly handles an invalid transition between block types in a Brotli stream. Instead of discarding the broken stream, the decoder misinterprets it as needing more input, continuing processing with an erroneous internal state.
Imperva’s memory-sanitizer tests revealed that this behavior can lead to out-of-bounds memory writes, which are the foundation of the demonstrated exploit. The patched version of the decoder correctly returns a format error for these transitions.
Mitigation and Security Recommendations
To mitigate the risk, Node.js has released updates that fix this security flaw. The Node.js 24.22.1 release notes confirm the integration of the Brotli patch, effectively preventing the exploit.
Administrators are advised to update to Node.js versions 22.23.4, 24.22.1, or 26.12.1, or later. These updates are crucial to protect against potential attacks exploiting this vulnerability.
Organizations should also review their Node.js deployments to ensure that vulnerable binaries are replaced with secured versions and that services decoding untrusted Brotli-compressed requests or responses are scrutinized. Imperva has also introduced WAF rules to provide temporary safeguards against this exploit, though updating the runtime is essential for long-term security.
Staying ahead of potential threats by integrating threat intelligence feeds and updating defenses promptly is crucial for safeguarding systems against emerging malware.
