Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Summary: Imperva researchers demonstrated a proof of concept called Node2Shell that ran attacker-supplied code on the official Node.js 24.22.0 Linux arm64 image by feeding crafted data to the bundled Brotli decoder, tracked as CVE-2026-111497, which Node.js disclosed and fixed on October 21. The flaw affects applications on the 22.x, 24.x, and 26.x lines and is reachable through Brotli-compressed response bodies read via built-in fetch() or Brotli-compressed request bodies decoded by middleware such as Express 5 body parsers.
Bottom line: ELLIO reproduced a shell on the official 24.22.0 x86-64 binaries under default settings across four setups, and found the exploit is version-specific: an offset that worked on 24.22.0 produced nothing in 10,000 attempts against 22.23.3 and 26.12.0, so an operator measures a build once and reuses it against every host running it. Scanning and exploit traffic had already reached ELLIO's sensors by October 26, and the advisory lists no workaround inside Node.js, so an application that cannot update at once has no fallback in the runtime.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-111497
- Related
- Siemens Industrial Edge Management Cyber Risks · Nov 12, 2026Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026Siemens Desigo, Gridscale Cyber Risks · Nov 12, 2026