Node2Shell: From Compressed Format to RCE on Node.js, Demonstrated on Official Linux arm64 Build

On October 22, 2026, Imperva Red Team researchers published a demonstration of remote code execution on an official, unmodified build of Node.js 24.22.0 Linux arm64, exploiting crafted Brotli data. The vulnerability is tracked as CVE-2026-111497.

The Mechanism: A Bug in the Brotli Decoder

The bug resides in the c/dec/decode.c file of the Brotli decoder integrated into Node.js. According to Imperva's analysis, a crafted Brotli stream presents an impossible block transition that the vulnerable decoder interprets as a request for more input, rather than halting with an error. This invalid condition triggers an out-of-bounds buffer write.

Tests conducted with a memory sanitizer confirmed the out-of-bounds write stemming from the invalid condition. The Brotli decoder is invoked automatically by common data paths: Express 5 with body-parser 2.x automatically decodes Brotli request bodies when app.use(express.json()) is active, as verified in source code by Brandefense. Simultaneously, Node.js's native fetch() automatically decodes Brotli responses.

From Crash to Shell: Overcoming the Previous Limit

The first public proof of concept for this vulnerability achieved code execution only on deliberately weakened research builds. On standard builds, the author of that PoC reported a crash and limited process memory read, not code execution.

Imperva's work overcomes this limit. The researchers operated on Node.js 24.22.0 Linux arm64, the official build distributed by the project, without resorting to instrumented binaries or debug configurations.

"Our standalone proof of concept ran code carried in a Brotli response or request body inside applications using the official Node.js 24.22.0 Linux arm64 image. It needed no debugger or instrumented binary." — Imperva Red Team

The researchers described the result with a marker file: "In the working proof of concept, the test application had no code to create our marker file. After it received the Brotli data, the file appeared. Code carried in that data had run inside the target process."

The same input, tested on Node.js 24.22.1, was rejected without generating a marker.

"The same inputs on Node.js 24.22.1 were rejected and created no marker." — Imperva Red Team

Imperva specified that the proof of concept "did not succeed on every attempt." The results confirm code execution for the tested configurations, but the process requires multiple attempts.

Attack Paths and Exposed Runtimes

The attack surface does not require the application to explicitly implement Brotli decompression. Express 5 depends on body-parser in the 2.x series, which automatically decodes br, gzip, deflate, and zstd formats with the inflate option enabled by default. A server with app.use(express.json()) exposes the vulnerable decoder to attacker-controlled data.

The second path runs through Node.js's native fetch(): an HTTP response with Brotli Content-Encoding is decoded automatically, without application code intervention. This vector hits both clients consuming external APIs and server-side logic making outbound calls.

Bun was vulnerable up to version 1.4.4, according to Aikido. Deno and other runtimes are not mentioned in the available sources.

Why the Risk Assessment Changes

Fact: Before the Imperva demonstration, the vulnerability was perceived as limited to crashes or memory reads on standard builds. The first public PoC had not achieved RCE on production configurations.

Analysis: The demonstration on an official build moves CVE-2026-111497 from the category of theoretical bugs to that of practical exploits, at least for the tested architecture. The PoC's non-determinism does not eliminate the risk: an attacker with retry capability can still achieve execution.

Immediate Actions

• Upgrade the Node.js runtime to versions 22.23.4, 24.22.1, or 26.12.1, released on October 21, 2026: the fix is in the runtime, not in npm dependencies.
• Verify that container images in CI/CD and production do not restore vulnerable versions via layer caching or unpinned tags.
• Review managed platforms: Vercel has already enabled WAF rules as of October 21, but self-hosted infrastructure requires direct action.
• Ensure Bun, if present in the ecosystem, is updated to version 1.4.4 or later.

Caveats and Source Limitations

A researcher cited by Brandefense expressed doubts about the practical reachability of the bad write under real-world conditions, highlighting a line of dissent in the exploitability assessment. This view does not invalidate the Imperva demonstration, but signals that the security community has not reached a unanimous consensus on the ease of exploitation.

Imperva's tests refer exclusively to Node.js 24.22.0 on Linux arm64. It is not verified that the exploit works on x86_64 or other runtime versions. The precise success rate has not been quantified beyond the indication of "several tries."

The upstream fix, Brotli commit 0ed4268a, dates to February 2026 and was cherry-picked by Node.js in October. The sources do not comment on the reasons for this interval.

Sources

• thehackernews.com
• brandefense.io
• aikido.dev
• imperva.com
• brandefense.io