Node2Shell: Crafted Brotli Data Runs Code on a Stock Node.js Build
Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.
The Node.js Brotli bug patched on Oct. 21 has moved from “could allow code execution” to “did, on a stock build.” Imperva researchers ran attacker-supplied code on an application using the official Node.js 24.22.0 Linux arm64 image by feeding it crafted Brotli-compressed data, The Hacker News reports. They call it Node2Shell. No debugger, no weakened test build, though it took several attempts to land. We covered the underlying flaw in our earlier post.
For defenders
The bug: CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles. An impossible block-type change in the stream gets treated as a request for more input, so the decoder carries on in a broken state. Google’s CVE record scores the Brotli flaw CVSS v4.0 9.2. The Hacker News doesn’t give a Node-specific score.
Affected: Node.js 22.x, 24.x and 26.x, per the article. Imperva only tested 24.22.0 on arm64 Linux; other architectures and release lines weren’t tested. Node.js 24.22.1 rejected the same data. Node.js 20.x and older are end-of-life and won’t be fixed. See the Node.js October 2026 security releases for patched versions.
How an attacker reaches it: two paths. One is an app reading a Brotli response through Node’s built-in fetch(), so a malicious or compromised upstream server is enough. The other is middleware that decompresses Brotli request bodies. A bare Node HTTP server doesn’t decode bodies by itself, but Imperva reproduced the request path with Express 5’s json, urlencoded, text and raw parsers (Express 5.0.0 to 5.3.0, body-parser 2.0.0 to 2.3.0). That request path is T1190 (Exploit Public-Facing Application).
Status: Imperva’s PoC is public. An earlier public PoC only got code execution on a deliberately weakened build. No in-the-wild exploitation reported as of Oct. 22. Imperva and Vercel added inbound WAF rules, but those don’t cover Brotli responses your app fetches from elsewhere. Node.js lists no runtime workaround.
What it means for you
Node.js is the engine behind a lot of websites and web apps. Brotli is a compression format that makes web traffic smaller. The bug means a specially squeezed file can trick a Node app into running the attacker’s code. If you don’t build or host software, there’s nothing for you to do. If you run a small business on a web app someone built for you, ask them whether it’s on a patched Node.js version.
Do this now
- Update Node.js to the patched 22.x, 24.x or 26.x release. Move anything on 20.x or older to a supported line.
- Rebuild container images and anything else that bundles its own Node binary. Package inventories often miss those.
- Until you’ve patched, limit untrusted Brotli traffic where you can, as Imperva suggests. For example, have your reverse proxy reject requests with
Content-Encoding: bron routes that don’t need them, and be wary offetch()calls to servers you don’t control.
CVE at a glance
- CVSS
- 9.2 Critical (v4.0)
- EPSS
- 88% chance of exploitation in the next 30 days (higher than 99.7% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 27, 2026
- Public exploit
- Yes, reported in 65 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.