New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data
Node2Shell exploit allows RCE in Node.js apps via Brotli-compressed data.
Researchers have demonstrated Node2Shell, an exploit targeting CVE-2026-111497, a memory corruption flaw in Node.js's Brotli decoder. This vulnerability allows attackers to execute arbitrary code within Node.js applications by sending specially crafted, Brotli-compressed data. The flaw affects Node.js release lines 22.x, 24.x, and 26.x, with fixes available in updated versions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Imperva?
Get an email when a new story names Imperva, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA memory corruption vulnerability in Node.js's Brotli decompression library (CVE-2026-111497) allows attackers to achieve remote code execution simply by sending maliciously crafted compressed data to an affected application. This is particularly dangerous because Brotli decompression is a common, often implicit operation in web-facing Node.js services, meaning the attack surface is broad and exploitation requires no authentication. Fixes are available across all affected release lines (22.x, 24.x, 26.x), making delayed patching the primary risk factor. Organizations that lack timely patch processes or software inventory visibility will remain exposed while attackers weaponize the publicly demonstrated Node2Shell exploit.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-111497