As reported by The Hacker News, Imperva's Node2Shell proof-of-concept achieves remote code execution on a stock Node.js 24.22.0 build by feeding malformed Brotli data through the bundled decoder (CVE-2026-111497). That elevation matters more than the headline suggests: a previous public PoC had only managed a crash and a constrained memory read on standard builds, and the consensus was that reliable RCE on a hardened build was unlikely. Imperva has now crossed that line for at least one architecture, and the broader exposure surface is larger than the single test image suggests.
Vulnerability Details
| CVE | CVE-2026-111497 |
|---|---|
| Severity | High–Critical (RCE on tested build; upstream rating pending) |
| Affected | Node.js bundled Brotli decoder across 22.x, 24.x, and 26.x lines (only 24.22.0 arm64 Linux validated by Imperva) |
| Fixed In | Node.js 24.22.1 (released Oct 21, 2026); equivalent fixes expected for 22.x and 26.x lines |
| Patch Status | Patch available — Node.js imported upstream Brotli fix that aborts decoding on the invalid block transition |
| In-the-wild Exploitation | None reported as of Oct 22, 2026 |
Why This Matters
The decisive shift in this story is not the existence of the bug — it's that Imperva reproduced reliable-enough RCE on an official image without a debugger or custom compilation. Two attack paths are realistically reachable from the public Internet: server-side decoding of a Brotli-compressed upstream HTTP response via Node's built-in fetch(), and middleware decoding of an attacker-controlled Brotli-encoded request body. The second path is the more serious one, because request bodies are unauthenticated by default and attacker-shaped. Express 5's express.json(), urlencoded(), text(), and raw() parsers — and any app still on body-parser 2.x — now silently accept Brotli encoding when the client supplies it, turning every JSON or form endpoint into a potential decoder sink.
Key takeaway: any service where a remote client can choose the Content-Encoding of an inbound body, or where an upstream fetch response is decompressed by Node, is in scope for this flaw.
Who Is Most Exposed
- API gateways and Express 5.x services accepting compressed request bodies from untrusted clients.
- SSR / BFF layers that proxy upstream responses through Node's
fetch()with automatic decompression. - Serverless Node.js runtimes pinned to 24.22.0 or earlier 24.x images on Linux arm64 (a common container default).
- Internal tooling that ingests webhooks with Brotli-encoded payloads.
Shield53 Recommendations
express.json, body-parser, fetch(, and any custom Brotli handling. Treat each occurrence as an attack surface.Content-Encoding: br at the reverse proxy or load balancer when business logic doesn't require Brotli bodies, then re-decide per route.Content-Encoding: br but produce malformed streams, and alert on process crashes in Node workers that handle compressed payloads.
