Imperva Demonstrates Node.js Code Execution via Malicious Brotli Input
Imperva researchers showed that crafted Brotli data can make an official Node.js 24.22.0 Linux arm64 build execute attacker-supplied code. Their Node2Shell proof of concept exploited CVE-2026-111497 in the bundled Brotli decoder without a debugger or custom build.
Imperva's researchers reported that specially formed Brotli content can lead an official Node.js 24.22.0 build for Linux arm64 to run code chosen by an attacker. The demonstration, called Node2Shell, relied on CVE-2026-111497 within the Brotli decoder shipped with that runtime.
The proof of concept reportedly achieved this without a debugger or a custom-compiled Node.js version. That detail matters because it indicates the issue was exercised against a standard release configuration rather than a laboratory-only variant.
The finding could matter to organizations running affected Node.js builds, especially where untrusted Brotli-compressed data reaches the runtime. If exploitation is practical, attackers may seek ways to trigger code execution through ordinary data-processing paths. That may raise pressure to patch, monitor, and limit exposure, though real-world impact depends on deployment and whether vulnerable versions are in use.