Security researchers at Imperva have demonstrated remote code execution against an official, unmodified Node.js build using nothing but crafted Brotli-compressed data, turning a newly disclosed decoder flaw into a practical attack against real-world configurations.
The vulnerability, CVE-2026-111497, dubbed Node2Shell, is a high-severity out-of-bounds write in the Brotli decoder that Node.js statically bundles. According to Imperva’s October 22 write-up, the bug arises when a malformed Brotli stream declares one type of data block and then switches to another; instead of stopping with an error, the vulnerable decoder continues in an invalid internal state and writes past the end of its buffer. The exploit has been given a score of 9.2 Critical under CVSS v4.0. The National Vulnerability Database published its entry on October 22.
Imperva’s proof of concept ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build required. The researchers delivered their payload through two common paths: Brotli-compressed HTTP responses decoded automatically by Node.js’s built-in fetch(), and Brotli-compressed request bodies processed by Express 5.0.0–5.3.0 or body-parser 2.0.0–2.3.0 when configured to decompress Brotli. Imperva confirmed the patched 24.22.1 release rejects the same exploit inputs.
An independent proof of concept published on GitHub on October 23 reports a network-only RCE reproduction against a specific Node.js v24.9.0 “worker-record-transform” profile, using the same vulnerable Brotli state transition for a controlled 16-byte out-of-bounds write. Its author notes the result does not generalize to all Node.js releases or frameworks.
Who is affected
According to CERT Santé, France’s health-sector CERT, which issued an advisory on October 22, malformed Brotli input lets a remote attacker execute arbitrary code with the privileges of the Node.js process and disclose process memory. The advisory lists affected versions:
- Node.js 26.x before 26.12.1
- Node.js 24.x before 24.22.1
- Node.js 22.x before 22.23.4
Node.js 20.x and earlier are end-of-life and receive no fix; CERT Santé says they require migration to a supported, patched line. Per Indusface, the same applies to 25.x and 23.x.
The underlying bug resides in Google’s Brotli C library, not Node.js itself. Tenable lists vulnerable Brotli versions as 1.0.3 through 1.2.0, and Rescana, citing Google’s CVE record, says the buffer overflow lets a remote unauthenticated attacker corrupt adjacent decoder state, disclose memory, cause denial of service, or potentially execute arbitrary code.
Platform-level fixes are still incomplete. Amazon Linux’s security center lists brotli packages on Amazon Linux 2023 and Amazon Linux 2027 Preview as affected with fixes pending. CloudLinux warned that its alt-nodejs packages and cPanel’s ea-nodejs22 builds are affected, including end-of-life Node.js lines, and that updating the system brotli package alone does not help because each alt-nodejs build embeds its own vulnerable Brotli copy.
What to do
Node.js fixed the flaw in its October 21 security release. Experts recommend the following steps:
- Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4, or migrate from unsupported lines (25.x, 23.x, 20.x and older) to a patched branch.
- Upgrade any standalone Brotli libraries or binaries in the 1.0.3–1.2.0 range to 1.0.10, 1.1.1, or 1.2.1, per Tenable.
- Rebuild applications and container images to ensure they no longer pin vulnerable Node.js or Brotli versions.
- Avoid decoding Brotli data from untrusted sources, and review use of fetch() and middleware that transparently decompresses Brotli request bodies.
- Deploy updated alt-nodejs and ea-nodejs22 packages on CloudLinux and cPanel hosts, which CloudLinux stresses is separate from system package updates.
Exploitation status
As of October 24, public reporting centers on researcher proofs of concept rather than confirmed malicious campaigns. Security accounts on X amplified the demonstrations, with offensive security researcher Huda (@AlAssaf_H) noting on X that Imperva’s PoC required multiple attempts to trigger the invalid block transition and out-of-bounds write.
It remains unknown whether the Brotli state transition can be exploited beyond the specific configurations documented by Imperva and the GitHub PoC, and no national CERT beyond CERT Santé had added the flaw to a known-exploited-vulnerabilities catalog as of October 24.