Imperva Demonstrates Node2Shell Code Execution on Official Node.js Build
Imperva researchers have demonstrated code execution through the Node2Shell vulnerability, CVE-2026-111497, on the official Node.js 24.22.0 Linux arm64 image. The proof of concept used crafted Brotli-compressed data against the runtime’s bundled decoder, without a debugger or a custom-built Node.js binary.
Node.js disclosed the issue and released fixes on October 21. In Imperva’s testing, the same malicious data was rejected by Node.js 24.22.1 and no code executed. The company said its successful runs on Linux arm64 required several attempts, so the result does not establish equal exploitability across all environments.
What the demonstration establishes
The result advances beyond an earlier public proof of concept that achieved code execution only on a deliberately weakened test build. On a standard build, that earlier work reportedly caused a crash and enabled a limited process-memory read, but did not produce working code execution.
Imperva tested one official build and one application configuration. It did not test other architectures or the Node.js 22.x and 26.x lines for successful code execution. Nevertheless, the underlying vulnerable Brotli component is bundled across the supported 22.x, 24.x and 26.x release lines, making patching relevant to applications beyond the tested image.
Where applications can reach the decoder
An application may invoke the affected decoder while reading a Brotli-compressed response through Node.js’s built-in fetch(). It may also reach the decoder when middleware processes a Brotli-compressed HTTP request body.
Express 5 body parsers, including express.json(), express.urlencoded(), express.text() and express.raw(), decode Brotli request bodies when applied to a route, alongside gzip and deflate. A plain Node.js HTTP server does not automatically decompress a Brotli request body merely because it receives one; middleware or an explicit decoding call is needed.
Imperva reproduced code execution through both the request-body and response paths. Its pinned tests covered Express versions 5.0.0 through 5.3.0 and body-parser versions 2.0.0 through 2.3.0, rather than every intervening release.
Why malformed Brotli data matters
Imperva traced the defect to an impossible state during Brotli decoding. A stream declares the block types it will use as decoding proceeds, but the crafted input reached a block change that its own structure did not permit. The vulnerable decoder treated that state as a request for additional input and continued processing invalid data.
In a separate memory-sanitizer test, continuing from that invalid state wrote beyond an intended buffer. Node.js imported an upstream Brotli fix that stops decoding with a format error at that point instead of proceeding, addressing the out-of-bounds write behind the flaw.
Patch runtime artifacts, not just packages
Node.js advises affected users to move to a patched release. The update needs to reach container images and any other artifact that bundles a Node binary, which package inventories may not fully identify. End-of-life Node.js 20.x and earlier lines will not receive this fix and should be migrated to a supported release line.
The advisory lists no runtime-level workaround for applications that cannot immediately update. Imperva recommended limiting untrusted Brotli traffic on affected paths where practical, while stressing that only the update removes the vulnerability. Vercel said it added inbound-request rules on October 21, but such rules do not cover Brotli responses fetched from external servers. For businesses, the practical priority is to locate deployed Node.js binaries, upgrade affected 22.x, 24.x and 26.x instances, and verify the patched runtime is present in production artifacts.