Imperva researchers have demonstrated that malformed Brotli data can lead to attacker-controlled code running on an ordinary, unmodified Node.js build — a step beyond earlier experiments that only worked on a deliberately weakened test binary.
The proof of concept, called "Node2Shell", abuses CVE-2026-111497, a defect in the Brotli decoder that ships inside the runtime. Node.js disclosed the flaw and published fixes on October 21, 2026.
In Imperva's lab the payload executed on the official Node.js 24.22.0 image for Linux arm64. Nothing was rebuilt and no debugger was attached: the only input was crafted Brotli data handed to the bundled decoder. The result was not consistent — code execution came after several attempts. Imperva worked with one build and one application configuration, and did not examine other processor architectures or the 22.x and 26.x release lines. Fed to 24.22.1, the fixed release, the same data was rejected and nothing ran.
The first public proof of concept had reached code execution only against a build intentionally modified to make the bug easier to trigger. On a normal build, its author reported a crash and a partial read of process memory rather than code execution, and acknowledged that a working attack had not been achieved there.
As of October 22, no exploitation of the flaw in real-world attacks had been reported, The Hacker News said.
Two routes to the decoder
Because the vulnerable decoder is part of Node.js itself, exposure covers applications on the 22.x, 24.x and 26.x lines, not only the version Imperva tested. Traffic can reach it from either direction of an HTTP exchange: Node.js's built-in fetch() decompressing a Brotli-encoded response from another server, or middleware decompressing a Brotli-encoded request body.
In Express 5, the parsers express.json(), express.urlencoded(), express.text() and express.raw() handle Brotli request bodies — as they already did gzip and deflate — once attached to a route. A bare Node.js HTTP server does not decode a Brotli body simply because one arrives; that requires such middleware or an explicit call.
Imperva reproduced execution along both routes, request body and response. Its tests pinned versions within the Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 ranges rather than covering every release in them.
A block switch the format forbids
The trigger lies in how the decoder reacts to a state a valid Brotli stream cannot reach. A stream declares the block types it will use as decoding proceeds, and Imperva's input arrived at a block change that the stream's own structure ruled out. Instead of rejecting the stream, the decoder took the condition as a request for more input and continued in an invalid state.
A separate run under a memory sanitizer showed the consequence: a write past the end of an intended buffer, the memory corruption underlying the bug. Node.js addressed it by importing an upstream Brotli patch that makes the decoder stop with a format error at that point.
The CVE record describes the defect as a buffer overflow in the Brotli decoder source file c/dec/decode.c, affecting Google Brotli 1.0.3 through 1.2.0 on all platforms. According to that record, a crafted compressed stream lets an unauthenticated remote attacker corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. The record directs users of the library to version 1.0.10, 1.1.1 or 1.2.1.
Patching, and artifacts an inventory can miss
The remedy is to move to a patched Node.js release. Because Node binaries are often baked into container images and other build artifacts, a dependency inventory can overlook them. The 20.x line and earlier are end-of-life and will not receive the fix, so applications there need to move to a supported line.
Node.js's advisory lists no workaround inside the runtime, leaving applications that cannot update straight away without a fallback. Imperva recommended limiting untrusted Brotli traffic on affected paths where that is practical, while emphasizing that only an update removes the flaw. The company said it added web application firewall rules and tested them against the attacks it reproduced.
Vercel, which runs Node.js workloads for its customers, said it introduced rules on October 21 that block the attack in inbound requests. Those rules do not cover Brotli responses an application fetches from other servers, and they do not replace updating.
