Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Security researchers at Imperva have demonstrated a remote code execution exploit called 'Node2Shell' targeting a vulnerability in Node.js's bundled Brotli decoder. The proof of concept successfully ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64 without requiring a debugger or custom build. The attack works by feeding specially crafted Brotli data to the bundled Brotli decoder component. The vulnerability is tracked as CVE-2026-111497 and was disclosed by Node.js. The exploit requires no special configuration, making it particularly dangerous for any application running on an official Node.js build that processes Brotli-compressed data. The demonstration highlights a significant risk for production environments using standard Node.js deployments.