Node.js flaw let crafted Brotli data run code on official builds

How the flaw works

Security researchers at Imperva have shown that a flaw in the Brotli decoder bundled with Node.js could let an attacker run their own code on an official Node.js build by sending specially crafted Brotli-compressed data. This vulnerability, tracked as CVE-2026-111497, was demonstrated on the official Node.js 24.22.0 image for Linux arm64, without any debugger or custom build. The attack worked by feeding the decoder a Brotli stream that reached an impossible block change, causing the decoder to continue in an invalid state and eventually write outside its intended memory buffer. This is known as an out-of-bounds write, a common way attackers gain control over a program.

The researchers' proof of concept, called "Node2Shell", achieved code execution after several attempts in their test environment. Earlier public research had only managed to crash the program or read some memory, not run code, on standard builds. Imperva's demonstration marks the first reported code execution on an official, unmodified Node.js release using this flaw. No exploitation in the wild was reported as of 22 October 2026 [The Hacker News↗ (opens in a new tab)].

Who is affected

The flaw affects applications running Node.js versions 22.x, 24.x, and 26.x, not just the specific build tested. It can be triggered in two main ways: when an application reads a Brotli-compressed HTTP response using Node.js's built-in fetch(), or when middleware decodes a Brotli-compressed request body. Express 5's body parsers (like express.json(), express.urlencoded(), express.text(), and express.raw()) now support Brotli, so any route using these parsers could be at risk if it processes untrusted Brotli data. A plain Node.js HTTP server is not affected unless it actively decodes Brotli data.

Imperva tested Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0, but did not check every release. Other architectures and Node.js lines were not tested in this research, so the full scope is not yet clear.

The response

Node.js disclosed the flaw and released fixed versions on 21 October 2026. The fix comes from an upstream Brotli patch, which now causes the decoder to stop with a format error instead of continuing in an invalid state. The update is available as Node.js 24.22.1 and similar releases for other affected lines. The advisory says there is no workaround inside Node.js itself, so updating is the only reliable fix. End-of-life lines, such as 20.x and earlier, will not get a patch and should be upgraded to a supported version.

Imperva suggested limiting untrusted Brotli traffic where possible until updates are applied. The company also added detection rules to its own web application firewall. Vercel, a major Node.js hosting provider, deployed rules to block the attack in inbound requests, but these do not protect against Brotli-compressed responses fetched from other servers.

What you should do

Teams running Node.js should update to a patched version as soon as possible, especially if their applications decode Brotli-compressed data from untrusted sources. This includes checking container images and other artifacts that may bundle an outdated Node.js binary. Applications that cannot update immediately should try to block or limit untrusted Brotli data, but this is only a temporary measure. There is no built-in workaround in Node.js for this flaw.