Node.js patched a code-execution Brotli bug October 21

Node.js has released a patch to address a code-execution vulnerability in its Brotli decoder on October 21. The flaw, known as CVE-2026-111497, allows attacker-controlled data to be fed into the decoder, causing it to execute arbitrary code. This proof of concept, dubbed Node2Shell, was tested by Imperva researchers and demonstrated on an official Node.js 24.22.0 image for Linux arm64.

However, code execution was not achieved on every attempt and required several tries in that specific setup. The fixed build, 24.22.1, rejected the same input and prevented any code from running.

The vulnerability arises when the Brotli stream announces block types during decoding, but the stream structure rules out a block change that the decoder treats as a request for more input. This leads to an out-of-bounds write, which is the root cause of the issue. Node.js addressed this by incorporating an upstream Brotli patch that causes the decoder to stop with a format error instead of continuing. This patch is included in all current lines, including 22.x, 24.x, and 26.x.

Applications built on Node.js are exposed to this vulnerability, as the decoder is bundled. Any application that either receives Brotli-compressed responses or sends Brotli-compressed request bodies through Node.js middleware, such as Express 5's body parsers, is at risk. Imperva confirmed that they were able to reproduce code execution through both the request-body and response paths using Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0.

The response path is particularly concerning, as it does not require an attacker to reach your request handlers. A service that fetches from an upstream server and returns Brotli-encoded responses is also vulnerable.

To mitigate the risk, users should upgrade to the patched release, 24.22.1. There are no in-runtime workarounds available, so affected applications must be updated. As the fix is not available for Node.js versions 20.x and earlier, which are end-of-life, these versions must be moved to a supported line regardless. For applications that cannot update immediately, Imperva recommends limiting untrusted Brotli traffic on affected paths and implementing additional security measures, such as blocking the attack in inbound requests using a web application firewall.

Major platforms like Vercel have also added rules to their Node.js deployments to protect against this vulnerability.