Node.js Brotli decoder flaw allows remote code execution in official builds

Security researchers at Imperva have demonstrated a critical remote code execution vulnerability in the official Node.js runtime. By feeding specifically crafted Brotli compression data to the bundled decoder, they successfully executed arbitrary code on a standard Linux arm64 build of Node.js 24.22.0. The Node.js team disclosed the flaw, tracked as CVE-2026-111497, and released fixes on October 21, urging developers to update any application that processes untrusted Brotli streams.

What happened

The demonstration, dubbed "Node2Shell," marks a significant escalation from earlier proof-of-concept attempts. Previous researchers had only achieved code execution on deliberately weakened test builds, while standard builds would merely crash or allow limited memory reads. Imperva’s team, however, ran their exploit on an official Node.js 24.22.0 image without debuggers or custom modifications. While the exploit was not deterministic and required several attempts to succeed in their Linux arm64 environment, it confirmed that full code execution is possible on production-grade setups.

This vulnerability affects a wide range of applications because it resides in the Brotli decoder bundled with Node.js itself. It impacts the active 22.x, 24.x, and 26.x release lines. The risk is present whenever an application decodes Brotli-compressed data, which can happen in two primary ways: when reading a compressed response via the built-in fetch() API, or when middleware explicitly decodes a compressed request body. For instance, Express 5 body parsers now handle Brotli alongside gzip and deflate, meaning many modern backend services are exposed if they process incoming requests from untrusted sources.

Imperva tested this vector using Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0, reproducing code execution through both request and response paths. A plain Node.js HTTP server is not vulnerable by default unless it uses middleware or explicit calls to decode the body. As of October 22, there were no reports of active exploitation in the wild, but the availability of a working proof of concept on official builds raises the urgency for patching.

How it works

The root cause lies in how the bundled Brotli decoder handles invalid state transitions within a compressed stream. A Brotli stream announces the types of blocks it will use as decoding progresses. In the malicious input crafted by Imperva, the stream reached a block change that its own structure explicitly ruled out as impossible. Instead of rejecting this contradiction, the vulnerable decoder interpreted it as a request for more input and continued processing in an invalid state.

When the decoder continues in this corrupted state, it fails to enforce proper boundary checks. Tests using a memory sanitizer revealed that this logic error leads to an out-of-bounds write, where data is written past the intended buffer limits. This memory corruption creates the opening for an attacker to inject and execute code. The Node.js project resolved the issue by importing an upstream patch from the Brotli library. This fix ensures the decoder immediately stops and returns a format error when encountering such impossible structural contradictions, preventing the invalid state from ever occurring.

Key details

• Vulnerability ID: CVE-2026-111497 affects the bundled Brotli decoder in Node.js.
• Affected Versions: Active release lines 22.x, 24.x, and 26.x are vulnerable; end-of-life versions like 20.x do not receive fixes.
• Attack Vector: Crafted Brotli data sent via HTTP request bodies (decoded by middleware) or received via fetch() responses.
• Exploit Reliability: Imperva’s proof of concept required multiple attempts to succeed on Linux arm64 and was not tested on other architectures.
• Fix Status: Patches were released on October 21; version 24.22.1 rejects the malicious data safely.
• No Runtime Workaround: The advisory states there is no configuration change within Node.js to mitigate this; updating is the only remedy.

Why it matters

For software engineers and technical leads, this vulnerability highlights a hidden risk in dependency chains. Because the flaw is in the runtime itself rather than a third-party npm package, standard package inventory tools may not flag it. Developers often assume that compression libraries are safe, low-level utilities, but this incident proves they can be a direct path to remote code execution. Services that proxy external APIs or accept user uploads are particularly at risk if they automatically decompress content without strict validation.

The lack of a runtime workaround means that operational teams cannot simply toggle a feature flag to stay safe. If your infrastructure relies on container images or pre-built artifacts, you must ensure the underlying Node.js binary is updated. This often requires rebuilding and redeploying services, not just restarting them. Furthermore, platforms like Vercel have added web application firewall rules to block inbound attacks, but these do not protect against malicious Brotli responses fetched by your server from other hosts, leaving the outbound path vulnerable until patched.

What you can do

• Upgrade all Node.js instances to the latest patched versions in the 22.x, 24.x, or 26.x lines immediately.
• Audit your container images and CI/CD pipelines to ensure the base Node.js binary is updated, not just the application code.
• Identify services using Express 5 or body-parser that accept untrusted request bodies and prioritize their patching.
• Review usage of the built-in fetch() API to ensure responses from external, untrusted servers are handled cautiously.
• Migrate any applications still running on end-of-life versions like 20.x to a supported release line to receive security fixes.
• Monitor logs for unusual crashes or memory errors in services handling compressed data, which may indicate attempted exploitation.