Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Security researchers at Imperva have shown that malicious Brotli data can be used to execute attacker-supplied code on an official Node.js build. They demonstrated this using a proof of concept called Node2Shell, which successfully ran code on the official Node.js 24.22.0 image for Linux arm64. The exploit worked by feeding crafted data to the bundled Brotli decoder, exploiting a flaw identified as CVE-2026-111497. This was achieved without using a debugger or custom build. Node.js has disclosed the vulnerability. The researchers were able to achieve remote code execution using this method.