Security researchers have uncovered a critical vulnerability in Node.js, which allows malicious actors to execute code using specially crafted Brotli data. This exploit, termed ‘Node2Shell,’ was demonstrated by Imperva’s security team on a standard Node.js build, highlighting significant security risks.
Details of the Node.js Exploit
The Node2Shell vulnerability was successfully executed on the Node.js 24.22.0 image for Linux arm64 without any customizations. This was achieved by feeding malicious data to the integrated Brotli decoder, identified as CVE-2026-111497. Following this discovery, Node.js released a patch on October 21, urging users to update immediately to protect their applications that handle untrusted Brotli data.
Despite the proof of concept, Imperva noted that the exploit did not succeed consistently, requiring multiple attempts to achieve code execution. The issue was specific to the tested architecture, and similar tests on other versions and architectures remain unverified. The patched version, 24.22.1, effectively blocked the exploit, preventing any unauthorized code execution.
Impacted Applications and Services
This vulnerability affects applications utilizing the Brotli decoder across Node.js versions 22.x, 24.x, and 26.x. It is pertinent for services employing Node.js’s built-in fetch() to decode Brotli-compressed responses or middleware processing Brotli-compressed request bodies. Express 5’s body parsers have also been updated to decode Brotli request bodies, expanding the scope of potential exposure.
Imperva demonstrated the exploit through both request-body and response paths in Express versions 5.0.0 to 5.3.0, and body-parser versions 2.0.0 to 2.3.0, although not all versions were exhaustively tested.
Technical Insights and Mitigation
The flaw originates from the Brotli decoder’s handling of an unexpected point in a Brotli stream, which led it to process further input in an invalid state. This resulted in an out-of-bounds write, a critical security lapse. Node.js resolved the issue by integrating an upstream fix that forces the decoder to terminate with an error if such a condition arises.
For immediate protection, users should update to the latest patched release. The update is crucial for securing container images and other artifacts incorporating Node binaries. Older Node.js lines, such as 20.x, are no longer supported and require migration to a supported version.
Recommendations and Future Outlook
Node.js’s advisory stresses the importance of updating to a patched version, as no viable workaround exists within the current runtime. Limiting exposure to untrusted Brotli traffic can provide temporary relief, but comprehensive security demands an update. Imperva has also implemented protective rules in its web application firewall to mitigate the risk.
As of October 22, there are no reports of the vulnerability being exploited in the wild. However, companies like Vercel have preemptively enforced rules to block potential attacks. Despite these measures, updating remains the only sure method to eliminate the risk of this vulnerability.
