Imperva Demonstrates Node2Shell RCE Exploit on Official Node.js Build via Brotli Flaw

Security researchers at Imperva demonstrated a proof-of-concept exploit dubbed "Node2Shell" that achieved remote code execution on the official Node.js 24.22.0 image for Linux arm64 by feeding crafted input to the bundled Brotli decoder (CVE-2026-111497). Unlike an earlier public proof of concept that only achieved code execution on a deliberately weakened test build and caused a crash with a limited memory read on a standard build, Imperva's test ran attacker-supplied code on an official build with no debugger or custom modifications, though it required several tries and did not test other architectures or the 22.x and 26.x lines. The vulnerability stems from an out-of-bounds write across the Node.js 22.x, 24.x, and 26.x release lines when the decoder encounters an impossible block change in a Brotli stream, causing it to request more input and continue in an invalid state. Imperva reproduced code execution across both inbound request-body decoding—testing pinned versions of Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0—and outbound HTTP responses read through Node.js's built-in fetch() API. Node.js disclosed and patched the vulnerability on October 21 (including in version 24.22.1) with no runtime workaround available and no fix for end-of-life 20.x and earlier lines, while no in-the-wild exploitation was reported as of October 22.