Security researchers at Imperva have demonstrated a critical vulnerability in Node.js, dubbed "Node2Shell," that allows for remote code execution (RCE). The exploit leverages crafted Brotli data to make an application on an official build of Node.js run attacker-supplied code.
The proof of concept successfully ran code on the official Node.js 24.22.0 image for Linux arm64 without requiring a debugger or custom build. This was achieved by feeding specially crafted data to the bundled Brotli decoder, leading to CVE-2026-111497.
Node.js has disclosed the flaw, indicating the potential for significant security risks if applications do not properly handle Brotli-compressed data.
Sources and references
Original report
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 008T3DAR
Cite this
APA
Interestana AI Editorial. (2026, October 23). Node.js Vulnerability Allows Remote Code Execution via Brotli Data. Interestana. https://interestana.com/articles/researchers-demonstrate-node2shell-rce-exploit-on-nodejs-build-using-crafted-brotli-data-008t3dar
MLA
“Node.js Vulnerability Allows Remote Code Execution via Brotli Data.” Interestana, 23 Oct. 2026, interestana.com/articles/researchers-demonstrate-node2shell-rce-exploit-on-nodejs-build-using-crafted-brotli-data-008t3dar.
Chicago
Interestana AI Editorial. “Node.js Vulnerability Allows Remote Code Execution via Brotli Data.” Interestana, October 23, 2026. https://interestana.com/articles/researchers-demonstrate-node2shell-rce-exploit-on-nodejs-build-using-crafted-brotli-data-008t3dar.
BibTeX
@misc{interestana_008t3dar,
author = {{Interestana AI Editorial}},
title = {{Node.js Vulnerability Allows Remote Code Execution via Brotli Data}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/researchers-demonstrate-node2shell-rce-exploit-on-nodejs-build-using-crafted-brotli-data-008t3dar},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html}
}Credit the source
Original reporting: The Hacker News, “Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data”, https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe