Researchers Expose Critical RCE Flaw in Node.js That Lets Hackers Execute Shell Commands
Researchers at Imperva have demonstrated a critical vulnerability in Node.js that allows attackers to execute arbitrary code through a flaw in its bundled Brotli decoder. The vulnerability, tracked as CVE-2026-111497, was successfully exploited in their "Node2Shell" proof of concept against the official Node.js 24.22.0 Linux arm64 image without requiring any debugger or custom build. Node.js disclosed the issue and released patches on October 21, and administrators running any application that processes untrusted Brotli-compressed data should update immediately to version 24.22.1 or the equivalent patched release for their version line.
The vulnerability affects Node.js versions 22.x, 24.x, and 26.x and can be triggered through two primary attack vectors. The first occurs when Node.js's built-in fetch function processes a Brotli-compressed response, and the second happens when middleware decodes a Brotli-compressed request body. Applications using Express 5 are particularly at risk since its body parser middleware now automatically decodes Brotli request bodies alongside gzip and deflate compression. Imperva confirmed successful exploitation through both attack paths on Express versions 5.0.0 through 5.3.0 and body-parser versions 2.0.0 through 2.3.0.
The root cause stems from how the decoder handles an impossible state within a Brotli data stream. When the decoder encounters a block change that should be impossible according to the stream's own structure, the vulnerable version treats it as a request for more input and continues processing in an invalid state. This leads to an out-of-bounds write that attackers can leverage for code execution. Node.js addressed the issue by importing an upstream Brotli patch that makes the decoder properly halt with a format error instead of continuing in the corrupted state.
While Imperva's exploit did not work on every attempt and only applied to their specific test configuration, this represents a significant advance over earlier proof-of-concept attempts that only achieved code execution on deliberately weakened builds. As of late October, no widespread in-the-wild exploitation had been confirmed, though at least one crafted exploit was detected by threat intelligence sensors. Organizations should prioritize updating to patched releases and ensure that container images and bundled Node binaries are also updated, as these can be missed by standard package inventories. End-of-life versions 20.x and earlier will not receive patches and should be migrated to supported versions.
Stay secure — stay Wavasec. 🔐
