Researchers demonstrated code execution through a flaw in the Brotli decoder bundled with Node.js. Here is how applications can be exposed and which patched versions developers should use.
A security demonstration called Node2Shell shows how malicious compressed data can lead to code execution in a Node.js application.
According to The Hacker News, Imperva researchers demonstrated the attack against the official Node.js 24.22.0 Linux arm64 image, without a custom build or debugger. The exploit required multiple attempts, and the findings should not be interpreted as proof of reliable exploitation across every platform.
What Is the Vulnerability?
Tracked as CVE-2026-111497, the vulnerability involves an out-of-bounds write in the Brotli decoder bundled with Node.js. The Node.js project classifies the issue as high severity and identifies the 22.x, 24.x, and 26.x release lines as affected.
Brotli is a compression format used to reduce the size of web content. Applications can encounter the vulnerable decoder when processing compressed data from untrusted sources.
Where Can Applications Be Exposed?
The reported attack paths include middleware that decompresses incoming Brotli request bodies and applications receiving Brotli-compressed responses through Node.js’s built-in fetch().
Simply receiving a compressed request does not automatically expose every Node.js HTTP server: the application must actually decode the data.
The report states that no exploitation in the wild had been reported as of October 22, 2026.
What Should Developers Do?
Node.js released security updates on October 21. The patched versions listed in its advisory are:
• 22.23.4
• 24.22.1
• 26.12.1
Teams should update their runtime and rebuild any container images or deployment artifacts that bundle an affected Node.js binary. They should also review where their applications decompress externally supplied data.
Restricting untrusted Brotli traffic may reduce exposure temporarily, but updating the runtime remains the essential fix.
Sources:
The Hacker News: https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html
Node.js Security Advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
