Node.js Vulnerable to RCE via Crafted Brotli Data (Node2Shell)

Security researchers at Imperva have demonstrated a critical remote code execution (RCE) vulnerability within Node.js, officially designated as CVE-2026-111497 and nicknamed "Node2Shell." The exploit leverages specially crafted Brotli compressed data to achieve arbitrary code execution on official Linux arm64 builds of Node.js version 24.22.0. This attack vector bypasses the need for custom builds or debuggers, making it a significant threat to applications handling untrusted Brotli data.

The vulnerability resides in the Brotli decoder bundled with Node.js. Researchers successfully executed their proof-of-concept by feeding malformed Brotli data to the decoder, causing it to enter an invalid state and overwrite memory. This out-of-bounds write, triggered by an impossible point in the Brotli stream, allows an attacker to inject and run their own code. While Imperva's demonstration required several attempts on their specific Linux arm64 setup, the patched version, Node.js 24.22.1, successfully rejected the malicious data, preventing code execution.

Node.js officially disclosed the flaw and released patches on October 21, urging all applications that decode untrusted Brotli data to update immediately. The vulnerability affects Node.js versions 22.x, 24.x, and 26.x, as the Brotli decoder is a shared component across these lines. This means a wide range of applications, including those using Express 5's body parsers or Node.js's built-in fetch() for handling Brotli-compressed responses, are potentially vulnerable.

Imperva's proof-of-concept successfully demonstrated code execution through both request-body and response paths. They tested this against Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0, confirming the exploit's efficacy in common web application middleware. While the initial public proof-of-concept only achieved code execution on a deliberately weakened test build, Imperva's work shows a viable attack against standard, official Node.js builds.

As of October 22, no exploitation of this vulnerability in the wild has been reported. However, the potential for widespread impact necessitates prompt action from developers and system administrators. The Node.js team addressed the flaw by importing an upstream Brotli patch that ensures the decoder halts with a format error when encountering malformed data, rather than continuing in an unstable state.

Node.js has released patched versions for its supported lines, and users are strongly advised to update to these releases. For older, end-of-life versions (20.x and earlier), migration to a supported Node.js line is the only solution, as these versions will not receive the fix. There is no workaround within Node.js itself, meaning applications unable to update immediately are left without a runtime-level mitigation.

While Node.js itself does not offer a workaround, Imperva suggested limiting untrusted Brotli traffic on affected application paths where feasible. They also implemented protective rules in their own Web Application Firewall (WAF) to detect and block attacks based on their findings. Vercel, a popular Node.js hosting platform, has also deployed rules to block such attacks in inbound requests, though these do not cover Brotli responses fetched from external servers and do not negate the need for updating Node.js.

The Node2Shell vulnerability highlights the ongoing risks associated with bundled libraries and the importance of keeping software, including development runtimes, up-to-date. The ability to achieve RCE through seemingly innocuous data compression formats underscores the need for robust input validation and timely patching across the software supply chain.