Node2Shell: Researchers Achieve RCE on Stock Node.js Builds via Malicious Brotli Data

A proof-of-concept exploit dubbed Node2Shell has shown that crafted Brotli-compressed data can lead to remote code execution on an unmodified, official Node.js build. Researchers at Imperva demonstrated the attack against the official Node.js 24.22.0 Linux arm64 image, achieving code execution without a debugger, custom compilation, or any special build configuration.

The underlying flaw is tracked as CVE-2026-111497 and lives in the Brotli decoder bundled with Node.js. According to the researchers, the exploit works by feeding maliciously crafted data to that decoder, which is reachable in ordinary applications that decompress Brotli content — a common pattern for HTTP response handling, static asset serving, and API payloads.

Why This Matters

Brotli is a widely deployed compression algorithm supported by most modern browsers and many server frameworks. Because Node.js ships its own copy of the Brotli decoder, the vulnerable code is present by default in affected releases — developers do not need to install an additional package to be exposed. That raises the stakes considerably: any service that accepts or processes attacker-influenced Brotli data may be a candidate for exploitation.

The Imperva demonstration is notable for what it did not require. Running against the official Node.js 24.22.0 image for Linux arm64, the researchers relied on nothing beyond a stock runtime. No debugging hooks, no instrumented binaries, and no bespoke build steps were involved. In practical terms, that moves the finding from a laboratory curiosity to a realistic attack surface for production containers built on the official image.

The Technical Picture

Compression libraries are a frequent source of memory-safety problems. Decoders parse highly structured, attacker-controlled input and perform complex buffer management, making them attractive targets. When a decoder flaw permits memory corruption, the path from a malformed input to control-flow hijacking can be short — and in Node.js, the decoder runs inside the same process as the application, so a successful exploit inherits the process's privileges.

The Node2Shell name reflects that outcome: a compression input becomes a shell. The researchers have not, at the time of the disclosure, published a full technical write-up detailing the specific memory-safety primitive involved, but the proof of concept confirms the flaw is exploitable rather than merely theoretical.

Disclosure and Response

Node.js has disclosed the vulnerability, and the Imperva research follows the coordinated disclosure process. Organizations running Node.js should treat this as a priority patching item. The standard remediation path is to upgrade to a Node.js release that contains the fix, then rebuild container images so that the patched runtime is baked in rather than relying on runtime substitution.

Practical Guidance for Defenders

  • Patch promptly. Identify which Node.js versions your services run and move to a fixed release. Pay particular attention to long-lived container base images, which can silently retain vulnerable runtimes for months.
  • Rebuild, don't just restart. Because the flaw is in the bundled runtime, updating a lockfile or restarting a pod is not sufficient. Images must be rebuilt from patched base layers.
  • Inventory Brotli exposure. Determine where your applications decompress Brotli data, especially from untrusted sources. Endpoints that accept compressed request bodies deserve scrutiny.
  • Limit blast radius. Run Node.js workloads with least privilege, avoid running as root inside containers, and use seccomp/AppArmor profiles to constrain what a compromised process can do. A successful exploit inherits the process's permissions, so tighter runtime boundaries reduce impact.
  • Watch for follow-on research. Once a proof of concept exists, exploit development tends to accelerate. Expect public tooling and scanning activity to increase in the coming weeks.

The Bigger Lesson

Node2Shell is a reminder that the supply chain extends beyond npm packages. The runtime itself — and the native libraries compiled into it — forms part of the trusted computing base for every application built on top. Compression decoders, TLS stacks, and parsers bundled with language runtimes are frequently overlooked in dependency reviews because they never appear in a package manifest.

Security teams that track CVEs only at the application-dependency layer will miss findings like this one. Runtime-level vulnerabilities require their own patch cadence, their own asset inventory, and their own detection coverage. The Imperva research makes that case concretely: a single crafted payload, delivered to an ordinary decompression path, was enough to take control of a stock Node.js process.

For the full disclosure details, see the original reporting at The Hacker News.