Security researchers have uncovered a remote code execution (RCE) vulnerability dubbed “Node2Shell” in Node.js, tied to how its bundled Brotli decoder processes malicious data. The bug lets attackers run arbitrary code by feeding specially crafted Brotli-compressed input to a vulnerable Node.js build—without requiring any custom compile flags or debugger access.
What’s the issue?
The flaw (tracked as CVE-2026-111497) affects the official Linux arm64 build of Node.js 24.22.0. During testing, researchers from Imperva demonstrated the ability to execute code via the bundled Brotli decoder when it processes maliciously structured Brotli data. The same data fails to execute code on the fixed release, 24.22.1, which rejects the problematic stream and doesn’t fall victim to the vulnerability. The proof-of-concept exploit was applied to a fully standard build that ships with Node.js—no tweaks required. Earlier proofs had only worked on purposely weakened builds, or resulted in limited memory leaks without full code execution.
Which Node.js versions & use cases are at risk
All active lines using version 22.x, 24.x, and 26.x of Node.js are potentially vulnerable, because the bug lies in the bundled Brotli decoder. The vulnerability can be triggered via two primary paths: when decompressing Brotli responses received through Node.js’s built-in fetch() API, or when middleware (such as Express 5 or the body-parser package) handles Brotli-compressed request bodies.
Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0 were explicitly tested and shown to be exploitable via both request and response paths. A plain HTTP server in Node.js, however, will not decode Brotli from request bodies unless using such middleware or by explicitly enabling Brotli handling.
How it happens and how it was fixed
The root cause stems from how the decoder handles a “block type” change in a Brotli stream—one that the stream’s structure deems impossible. Instead of rejecting the malformed stream, the decoder waits for more input and transitions into an invalid state. In testing with memory-sanitizing tools, that state triggers a buffer overflow—allowing an out-of-bounds write.
The remedy: Node.js has incorporated an upstream patch for Brotli. The new behavior makes the decoder recognize format errors at the impossible block change and stop processing, preventing the dangerous continuation that enabled code execution.
What you should do now
The only reliable solution is to upgrade to a patched Node.js version (for example, 24.22.1). Assets like container images or packaged binaries that ship Node.js should also be updated—these are easy to overlook during inventory checks. Node.js lines 20.x and earlier are no longer supported and won’t receive patches—migration to a maintained line is essential.
In environments where immediate upgrade isn’t possible, limiting exposure to untrusted Brotli traffic on affected code paths can help reduce risk. Imperva also recommended using web application firewalls (WAFs) or traffic filters to block malicious input. One platform, Vercel, reportedly deployed rules as of October 21 to protect against attacks via inbound requests—but those rules do not guard against malicious Brotli-encoded responses fetched by applications.
No public exploitation—yet
As of October 22, there are no confirmed instances of this vulnerability being used in the wild. Imperva’s tests did not always succeed on Linux arm64 builds—code execution requires specific conditions and multiple tries. Other architectures, or version branches like 22.x and 26.x, have not yet been tested in full.
This discovery underscores how complex decompression logic—especially with newer or less-scrutinized features like Brotli—can introduce dangerous parsing bugs. Node2Shell isn’t just another edge-case flaw; it hits a built-in decoder on a fully official build, showing that even widely used runtimes can contain deep hidden risks.
