Researchers Show Crafted Brotli Data Can Run Code on a Standard Node.js Build

Security researchers at Imperva have demonstrated that specially crafted Brotli data can make an application on an official Node.js build run attacker-supplied code. Their proof of concept, called Node2Shell, worked on the official Node.js 24.22.0 image for Linux arm64 with no debugger or custom build. The flaw (CVE-2026-111497) sits in the Brotli decoder bundled with Node.js. Node.js disclosed it and released fixes on October 21, and applications that decode untrusted Brotli data should update. No exploitation in the wild had been reported as of October 22.

The result has limits. Code execution did not succeed on every attempt and took several tries, and it covers one build and setup. Other architectures and the 22.x and 26.x lines were not tested, although the flaw affects those lines too. On fixed release 24.22.1, the same data was rejected and no code ran. An earlier public proof of concept only achieved code execution on a deliberately weakened build; on a standard build it caused a crash and a limited memory read.

A service can reach the decoder when it reads a Brotli-compressed response using built-in fetch(), or when middleware decodes a Brotli-compressed request body. Express 5's body parsers now decode Brotli request bodies when applied to a route, while a plain Node.js HTTP server does not do so by itself. Imperva reproduced code execution through both paths, testing Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 at pinned versions. The cause was the decoder mishandling an impossible point in a Brotli stream and continuing in an invalid state.