Imperva Demonstrates RCE Through the Node2Shell Flaw in Node.js

Node2Shell in Node.js is a publicly documented case of remote code execution through CVE-2026-111497. Imperva’s security team said it executed code embedded in malicious Brotli data in applications running on the official Node.js 24.22.0 image for Linux arm64. The Node.js project disclosed the vulnerability on October 21, 2026, with a High rating and released fixed runtime versions.

The flaw is located in the bundled Brotli decoder. Processing malicious compressed data can cause an out-of-bounds buffer write. According to Node.js advisories, an attacker who supplies Brotli data to an application using decompression through the node:zlib module may cause a process crash, memory disclosure, or remote code execution.

Node2Shell in Node.js: What Imperva’s Test Showed

Imperva calls its research Node2Shell. According to its own description, its Red Team achieved execution of embedded code without using a debugger or a modified Node.js binary. The demonstration involved a specific combination: the official vulnerable Node.js 24.22.0 image, Linux on the arm64 architecture, and tested application paths.

The researchers tested the processing of Brotli data in a response handled by the built-in fetch() function. Another path involved incoming Brotli request bodies under tested configurations of Express 5 and the body-parser package. Imperva said that Node.js 24.22.1 rejected the same input.

This is a significant difference from the flaw’s basic memory-safety description: the research claims practically reproduced RCE, not merely a possible theoretical consequence of memory corruption. At the same time, the result does not confirm the same exploit reliability across all supported Node.js platforms, architectures, or configurations.

Which Versions Contain the Fix

Node.js released security updates in the following versions:

• Node.js 22.23.4,
• Node.js 24.22.1,
• Node.js 26.12.1.

The Google Brotli project also released a fix in version 1.2.1, where the security change is identified as CVE-2026-111497. Operators should therefore check not only the runtime version installed on servers, but also the base container images used for builds and deployment.

Who Is Affected and What to Do

Internet-facing Node.js services that decompress attacker-controlled Brotli data should be prioritized. This may include incoming HTTP bodies or responses that the application processes further. Applications using node:zlib, the built-in fetch(), or middleware that handles compressed requests are especially relevant.

A practical step is to update Node.js to the fixed release in the relevant supported line, replace vulnerable container images, and redeploy the fixed runtime.

Organizations should also identify services that accept or process untrusted Brotli data and check vendor advisories for products with their own bundled Brotli or decompression layer. The broader impact on other ecosystems and HTTP applications should be assessed according to the separate recommendations of specific vendors.

Active Exploitation Has Not Been Confirmed Yet

Available materials do not confirm active exploitation of CVE-2026-111497 in the wild. However, the public RCE demonstration means that patching vulnerable Node.js runtimes should be a priority wherever applications decompress attacker-supplied Brotli data.

Further developments will depend mainly on any credible confirmations of exploitation, the availability of fixes in distribution packages and container images, and advisories for products that process untrusted Brotli inputs.

Verified and updated: October 24, 2026 15:19