{
  "id": 16236993,
  "title": "Node.js patched a code-execution Brotli bug October 21",
  "url": "https://urgent.news/2026/10/23/node-js-patched-a-code-execution-brotli-bug-october-21",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T22:25:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/randomchaos/nodejs-patched-a-code-execution-brotli-bug-october-21-4obk"
  },
  "original_language": "en",
  "account": "Node.js has released a patch to address a code-execution vulnerability in its Brotli decoder on October 21. The flaw, known as CVE-2026-111497, allows attacker-controlled data to be fed into the decoder, causing it to execute arbitrary code. This proof of concept, dubbed Node2Shell, was tested by Imperva researchers and demonstrated on an official Node.js 24.22.0 image for Linux arm64. However, code execution was not achieved on every attempt and required several tries in that specific setup. The fixed build, 24.22.1, rejected the same input and prevented any code from running.\n\nThe vulnerability arises when the Brotli stream announces block types during decoding, but the stream structure rules out a block change that the decoder treats as a request for more input. This leads to an out-of-bounds write, which is the root cause of the issue. Node.js addressed this by incorporating an upstream Brotli patch that causes the decoder to stop with a format error instead of continuing. This patch is included in all current lines, including 22.x, 24.x, and 26.x.\n\nApplications built on Node.js are exposed to this vulnerability, as the decoder is bundled. Any application that either receives Brotli-compressed responses or sends Brotli-compressed request bodies through Node.js middleware, such as Express 5's body parsers, is at risk. Imperva confirmed that they were able to reproduce code execution through both the request-body and response paths using Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0. The response path is particularly concerning, as it does not require an attacker to reach your request handlers. A service that fetches from an upstream server and returns Brotli-encoded responses is also vulnerable.\n\nTo mitigate the risk, users should upgrade to the patched release, 24.22.1. There are no in-runtime workarounds available, so affected applications must be updated. As the fix is not available for Node.js versions 20.x and earlier, which are end-of-life, these versions must be moved to a supported line regardless. For applications that cannot update immediately, Imperva recommends limiting untrusted Brotli traffic on affected paths and implementing additional security measures, such as blocking the attack in inbound requests using a web application firewall. Major platforms like Vercel have also added rules to their Node.js deployments to protect against this vulnerability.",
  "summary": "Imperva's researchers ran attacker-supplied code on an official Node.js 24.22.0 image for Linux arm64, with no debugger and no custom build, by feeding crafted data to the Brotli decoder that Node bundles. The proof of concept, which they call Node2Shell, targets CVE-2026-111497. Node.js disclosed the flaw and shipped fixes on October 21. The result comes with limits worth stating up front. The…",
  "key_points": [
    "Node.js patched code-execution Brotli bug on October 21",
    "CVE-2026-111497 allows attacker-controlled data to execute arbitrary code",
    "Fixed build 24.22.1 rejects same input and prevents code execution"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}