Imperva researchers have demonstrated a proof-of-concept exploit—dubbed “Node2Shell”—that uses crafted Brotli-compressed data to achieve remote code execution (RCE) against an official Node.js 24.22.0 build for Linux arm64. The issue, tracked as CVE-2026-111497, was disclosed by Node.js and patched on October 21, 2026. While the demonstration did not work reliably on every attempt and targeted a specific build and architecture, it highlights a real risk for services that decode untrusted Brotli data.
What happened
Imperva fed specially constructed Brotli streams to the Brotli decoder that ships with Node.js and managed to run attacker-supplied code on an unmodified official Node.js 24.22.0 image for Linux arm64. Earlier public proofs of concept had achieved only crashes or limited memory reads on standard builds and full RCE only against deliberately weakened builds. In Imperva’s hands, code execution was possible without a custom Node build or debugger, though it required multiple attempts in their test environment. Node.js released a fix that causes the decoder to reject the malformed input with a format error, and the same crafted data is blocked on the patched 24.22.1 release.
Which applications are affected
Because the bug lies in the bundled Brotli decoder, it affects Node.js releases in the 22.x, 24.x, and 26.x lines (the decoder is part of those runtime binaries). There are two primary attack surfaces:
- Incoming requests: Middleware that automatically decodes Brotli-compressed request bodies (for example, Express 5 body parsers) can hand crafted data to the vulnerable decoder when applied to a route. Imperva successfully reproduced exploitation through this request-body path.
- Outbound responses: An application that fetches a Brotli-compressed response via Node.js’s built-in fetch() can also trigger the decoder on data received from remote servers, exposing the response-decoding path.
A plain Node.js HTTP server that merely receives a Brotli-compressed request does not necessarily decode the body by default; decoding happens when middleware or explicit calls invoke the decoder. Imperva tested Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0 at pinned versions and reproduced the issue—other intermediate releases were not exhaustively tested.
How the bug works
The Brotli stream format describes block types and transitions as decoding proceeds. The crafted input drives the decoder to an “impossible” point: a declared block change that the stream’s structure should never reach. Instead of treating that condition as a format error, the vulnerable decoder continued processing, asking for more input while in an invalid internal state. Under memory-sanitizer-assisted testing, Imperva observed that continuing from that invalid state produced an out-of-bounds write—an ideal primitive for turning a memory corruption into code execution. The Node.js team addressed the root cause by pulling in an upstream Brotli patch that causes the decoder to stop with a format error at that point rather than proceeding.
Mitigation and recommended actions
The only reliable mitigation is to update to a patched Node.js release. Node.js published fixes on October 21, and upstream container images and packaged artifacts that include the Node binary must be updated as well. Be aware that package inventories can miss embedded Node binaries inside container images, language bundles, or platform provider images—so inventories should be scanned at the image level.
Other key points for operators:
- If you run Node.js 24.22.0 (or other affected builds on 22.x, 24.x, 26.x), prioritize updating to the patched release (for example, 24.22.1 where the crafted data is rejected).
- End-of-life lines (20.x and earlier) will not receive fixes. Migrate any services on EOL versions to a supported release line immediately.
- There is no in-runtime workaround inside Node.js listed in the advisory. If you cannot update immediately, consider limiting or blocking untrusted Brotli-compressed traffic on affected code paths where practical.
- Web application firewalls (WAFs) and platform providers may deploy temporary rules. Imperva and Vercel reported adding WAF rules to block the attack in inbound requests; however, WAF rules do not replace updating the runtime and do not cover Brotli responses fetched from external servers.
- As of the report’s publication, there were no confirmed in-the-wild exploitations observed, but the demonstrated capability and ease of triggering the decoder warrant urgent patching.
Practical steps for operators and dev teams
- Inventory and scan: Identify all Node.js runtimes in use, including binaries inside container images, platform images, CI artifacts, and vendor images. Look specifically for 22.x, 24.x, and 26.x lines.
- Patch and rebuild images: Update Node.js to the patched releases and rebuild container images, language bundles, and artifacts that embed Node. Redeploy in a controlled manner with CI/CD validation.
- Harden request paths: If your application decodes request bodies automatically (for example via Express 5 body parsers), consider temporarily disabling Brotli decoding on public or untrusted routes, or restrict Brotli handling to trusted internal traffic until you can patch.
- Apply compensating controls: Deploy WAF rules that detect and block suspicious Brotli frames if available, and ensure your CDN or platform provider is informed and has applied provider-side mitigations.
- Monitor for anomalies: Watch for crashes, OOM events, or unusual process restarts that might indicate attempted exploitation attempts. Log and retain Brotli-decoding related errors for forensics.
- Test dependencies: If your app fetches data from third-party services that return Brotli-compressed responses, evaluate the risk of decoding that content and consider disabling automatic response decompression for untrusted upstreams until patched.
Final thoughts
Node2Shell underscores the broader lesson that complex binary formats and in-process decoders are attractive targets for exploitation. Even officially maintained, default decoders can contain edge-case flaws that transform malformed—but otherwise harmless-looking—data into a serious runtime compromise. For operators, the path forward is clear: treat this as an urgent patch-and-validate task, inventory all embedded Node runtimes, and apply defensive controls while you update. The fix exists; the window of risk remains open only until deployments are caught up.
Licensed under CC BY-ND 4.0 International
