Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Reported by The Hacker News ([email protected] (The Hacker News))

Summary by Cyber Security News23 Oct 2026, 09:50 CET

About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

Read the full article at The Hacker News →

Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

Node2Shell: Brotli Flaw Hits Python Packages

Vulnerabilities in node.js Affecting Cisco Products: October 2026

Multiple Node.js CVEs

Brotli2Shell: Beyond Node(2Shell) and HTTP(2Shell)

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software