A critical vulnerability in Node.js’s bundled Brotli decoder can lead to Remote Code Execution (RCE), allowing attackers to exploit applications that pass untrusted data to the native decoder. The vulnerability also impacts Brotli implementations in Python and other packages built on libbrotli.
The flaw, tracked as CVE-2026-111497 and dubbed Node2Shell by Imperva researchers, is an out-of-bounds write vulnerability in Brotli, Google’s open-source general-purpose data compressor.
Attackers can exploit the flaw to corrupt decoder memory, potentially expose sensitive memory contents, and cause a denial of service. Node.js released patches for the flaw last week, in versions 22.23.4, 24.22.1, and 26.12.1.
Imperva and ELLIO researchers have demonstrated that the flaw can be exploited for remote code execution.
How researchers achieved code execution
To exploit the flaw, Imperva ran a proof of concept against applications using the official Node.js 24.22.0 Linux ARM64 image. Their analysis found that applications can pass untrusted data to the vulnerable decoder when decompressing responses from another server or using middleware to decode incoming request bodies.
“Both operations can send untrusted data into the native decoder bundled with Node.js,” Imperva said.
In the case of ELLIO, researchers exploited the flaw to turn a malformed Brotli body into a shell, demonstrating remote code execution across four test configurations. These included a plain node:http server, the official node:24.22.0-slim image running as root, Express 5.3.0, and Koa 3, two web application frameworks for Node.js.
Aikido Security added the vulnerability also affects Brotli implementations in Python and other packages built on libbrotli.
To prevent potential exploitation, Aikido Security recommends that Node.js users block incoming requests with Content-Encoding: br at their reverse proxy, load balancer, or application middleware. The company also recommends deploying edge rules.
“Only a runtime upgrade removes the flaw, so treat stopgaps as a bridge to it,” the company added.
