Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Security researchers at Imperva demonstrated a remote code execution (RCE) exploit named 'Node2Shell' targeting a vulnerability in the Brotli decoder bundled with Node.js. The exploit leverages crafted Brotli-compressed data to trigger an out-of-bounds write, leading to code execution in unpatched versions of Node.js 22.x, 24.x, and 26.x. The vulnerability, tracked as CVE-2026-111497, was patched in Node.js 24.22.1 and other updated releases, with no known in-the-wild exploitation observed as of October 22, 2026.

AI-extracted · verify before operational use