Node2Shell RCE Flaw Exposes Node.js Apps to Remote Code Execution
Security researchers demonstrated a critical RCE vulnerability in Node.js via malicious Brotli data. The flaw affects official builds and highlights risks in widely used compression libraries.
TL;DR
- Researchers at Imperva found a remote code execution flaw in Node.js called Node2Shell.
- The exploit uses crafted Brotli data to bypass protections in official Node.js builds.
- Affects Node.js v24.22.0 on Linux arm64 with no need for debuggers or custom binaries.
- The issue stems from the bundled Brotli decoder (CVE-2026-111497).
- Organizations should monitor updates and validate input handling for compressed data.
A newly disclosed vulnerability in Node.js allows attackers to execute arbitrary code using specially crafted Brotli-compressed data. Security researchers at Imperva developed a working proof-of-concept exploit, dubbed "Node2Shell," that targets the official Node.js 24.22.0 image for Linux arm64.
This remote code execution (RCE) flaw arises from improper validation within the built-in Brotli decoder, tracked as CVE-2026-111497. Notably, the exploit works without requiring modified binaries or debugging tools, making it more accessible to threat actors targeting server-side JavaScript applications.
Technical Details of the Node2Shell Exploit
- The vulnerability resides in the Brotli decompression module bundled with Node.js.
- Attackers supply malformed compressed data that triggers unexpected behavior during decoding.
- Successful exploitation grants control over application execution flow, enabling arbitrary shell commands.
- Imperva's PoC demonstrates full RCE on standard Node.js containers with default configurations.
Impact and Mitigation Recommendations
- Organizations running Node.js applications should assess exposure to Brotli-based input sources.
- Immediate actions include validating all untrusted compressed content before processing.
- Developers are advised to apply patches once available and restrict unnecessary decompression routines.
- Long-term defense requires deeper scrutiny of third-party codecs integrated into runtime environments.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.