Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Imperva researchers achieved code execution on unmodified Node.js 24 via crafted Brotli data — a data-only exploit requiring no debugger — putting every enterprise Node.js deployment on notice.
Summary written by editorial AI · Source link below
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.
Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw
Editorial Analysis
Node.js underpins vast swathes of enterprise web infrastructure; a data-only RCE against official builds could be weaponised at scale before patches propagate.
Inventory all Node.js deployments including containerised workloads and prepare for rapid patching as soon as an upstream fix is available.
A new exploit technique achieves remote code execution on standard Node.js installations, potentially affecting a large portion of enterprise web services.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- Compromised TLS Certificates3d