Imperva Demonstrates Node2Shell RCE on Node.js via Crafted Brotli Data

Exploit Demonstrated

Researchers at Imperva presented a proof of concept called Node2Shell that achieves remote code execution on the official Node.js 24.22.0 Linux arm64 image. The attack feeds specially crafted Brotli compressed data to the bundled Brotli decoder, triggering CVE-2026-111497. The exploit required several attempts in the test environment and succeeded only on that specific build; the fixed release 24.22.1 rejects the malicious data and prevents code execution.

Affected Applications

The vulnerability resides in the Brotli decoder that Node.js includes, so all applications running on the 22.x, 24.x and 26.x release lines are potentially exposed. A service can reach the decoder when it reads a Brotli compressed response via the built in fetch function or when middleware decodes a Brotli compressed request body. Express 5 body parsers such as express.json, express.urlencoded, express.text and express.raw now decode Brotli request bodies, as does body-parser versions 2.0.0 through 2.3.0. A plain Node.js HTTP server does not decode Brotli request bodies automatically.

Technical Details

Imperva traced the flaw to the decoder's handling of an impossible block transition in a Brotli stream. The malicious stream announces block types that the stream structure rules out, causing the decoder to request more input and continue in an invalid state. A memory sanitizer test showed that continuing from that state writes past an intended buffer, producing the out of bounds write that underlies the vulnerability. Node.js addressed the issue by importing an upstream Brotli patch that makes the decoder stop with a format error at the problematic point.

Mitigation

The only reliable remediation is updating to a patched Node.js release. End of life lines such as 20.x do not receive the fix and should be migrated to a supported line. The advisory lists no runtime workaround, so applications that cannot update immediately have no fallback in Node.js itself. Imperva recommends limiting untrusted Brotli traffic on affected paths where practical. Vercel added web application firewall rules on October 21 that block the attack in inbound requests, though those rules do not cover Brotli responses fetched from external servers and do not replace updating.

Sources: The Hacker News