Security researchers at Imperva have demonstrated that malicious Brotli data can make an application running on an official Node.js build execute attacker-supplied code. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 Linux arm64 image without a debugger or custom build by feeding crafted input to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw and released fixes on October 21; applications that decode untrusted Brotli data should update.

The test did not succeed on every attempt-code execution took several tries on the Linux arm64 setup-and covers only that build and application configuration. Other architectures and the 22.x and 26.x lines were not tested. On the fixed release, 24.22.1, the same data was rejected and no code ran.

This goes beyond the first public proof of concept, which achieved code execution only on a deliberately weakened test build. On a standard build, that proof of concept's author reported a crash and a limited read of process memory, not code execution. No exploitation in the wild had been reported as of October 22.

The flaw sits in the Brotli decoder Node.js bundles, affecting applications on the 22.x, 24.x and 26.x lines. A service reaches the decoder when it reads a Brotli-compressed response through Node.js's built-in fetch(), or when middleware decodes a Brotli-compressed request body. Express 5's body parsers now decode Brotli request bodies when applied to a route. Imperva reproduced code execution through both the request-body and response paths, testing Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 at pinned versions.

Imperva traced the cause to how the decoder handles an impossible point in a Brotli stream: the test input reached a block change that the stream's own structure ruled out, and the vulnerable decoder read it as a request for more input and continued in an invalid state. A memory sanitizer test showed that continuing from that state wrote past an intended buffer-the out-of-bounds write behind the flaw. Node.js fixed it by importing an upstream Brotli patch that makes the decoder stop with a format error instead.

The fix is to move to a patched release, which should also reach container images and other artifacts bundling a Node binary that a package inventory can miss. End-of-life lines 20.x and earlier will not receive the fix. The advisory lists no workaround inside Node.js. Imperva suggested limiting untrusted Brotli traffic on affected paths where practical, and said only the update removes the flaw. Vercel said it added rules on October 21 that block the attack in inbound requests, though they do not cover Brotli responses an application fetches from other servers and do not replace updating.

Source: The Hackers News