As cited
Copy frozen at (site build).
vulnerabilities
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Imperva researchers demonstrated a remote code execution vulnerability in Node.js 24.22.0 through specially crafted Brotli compression data. The proof of concept, called Node2Shell, successfully executed arbitrary code on an official Linux arm64 build without requiring a debugger or custom configuration. The flaw exists in the bundled Brotli decoder and was assigned CVE-2026-111497.
Why it matters: Node.js developers and operators using version 24.22.0 or other affected versions must assess whether they process untrusted Brotli-compressed data, as remote code execution is a critical threat requiring immediate patch evaluation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Imperva researchers developed a proof of concept exploit called Node2Shell that triggers remote code execution (RCE) in Node.js 24.22.0 through malicious Brotli compression data. The vulnerability (CVE-2026-111497) affects the bundled Brotli decoder and requires no debugger or custom build to exploit the official Linux arm64 image.
Why it matters: Node.js users running version 24.22.0 on arm64 Linux are at immediate risk of RCE if they process untrusted Brotli-compressed data; patching or upgrading is required to mitigate this critical exposure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Imperva researchers demonstrated a remote code execution (RCE) vulnerability in Node.js 24.22.0 through crafted Brotli compression data. The proof of concept, called Node2Shell, exploited CVE-2026-111497 to execute arbitrary code on an official Linux arm64 build without requiring a debugger or custom configuration.
Why it matters: Node.js users running version 24.22.0 or similar builds should assess whether Brotli-compressed data from untrusted sources reaches their applications, as this CVSS 9.2 flaw allows unauthenticated remote code execution.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Imperva researchers demonstrated remote code execution (RCE) on Node.js 24.22.0 by sending crafted Brotli data to the bundled decoder. The "Node2Shell" proof of concept exploited CVE-2026-111497 on an official Linux arm64 build without requiring a debugger or custom configuration.
Why it matters: Organizations running Node.js 24.22.0 or earlier versions are at immediate risk of RCE attacks via malicious Brotli payloads; patching and validating Brotli data sources is required.
- Source published
- First seen by Cybersecurity Tracker