Security · Updated 23 Oct, 02:10 pm IST
Researchers demonstrate Node2Shell RCE against Node.js Brotli decoder
Why it matters for readers: It demonstrates that specially crafted compressed data can exploit low-level decoder bugs and why patches matter.
- Imperva's proof of concept ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64 by feeding crafted Brotli data.1
- Node.js disclosed the vulnerability (CVE-2026-111497) and released fixes on October 21; the patched 24.22.1 release rejects the crafted data and prevented code execution in tests.1
- The flaw is in the bundled Brotli decoder and can affect Node.js 22.x, 24.x and 26.x lines where Brotli decoding of untrusted data occurs.1
- Imperva's exploit did not succeed on every attempt and required multiple tries in their Linux arm64 setup, and other architectures and Node.js lines were not fully tested.1
- No exploitation in the wild had been reported as of October 22.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started