Node2Shell RCE via Malicious Brotli Decompression

Security researchers at Imperva have successfully demonstrated a remote code execution (RCE) exploit, dubbed 'Node2Shell', against official Node.js builds. The vulnerability, tracked as CVE-2026-111497, resides in the bundled Brotli decoder. By providing a specifically crafted Brotli data stream, attackers can trigger an out-of-bounds write that leads to arbitrary code execution. While initial proofs-of-concept only achieved crashes, this new research confirms the feasibility of RCE on standard Linux arm64 builds.

The attack chain involves the decoder entering an invalid state when encountering an impossible point in a Brotli stream, subsequently writing past intended buffers. This can be triggered either by a server processing a malicious request body (e.g., via Express 5 middleware) or by a Node.js application fetching a malicious compressed response from a remote server.

This vulnerability is critical for organizations running Node.js 22.x, 24.x, or 26.x. Impact is particularly high for applications using `fetch()` on untrusted content or utilizing Express 5 body-parsers (`express.json()`, `express.raw()`, etc.) which now support Brotli by default. Immediate patching is required as there are no effective runtime workarounds.