Researchers publish proof of concept exploit for Node js Brotli vulnerability

Security researchers at Imperva have demonstrated a remote code execution exploit named Node2Shell, which targets a memory corruption vulnerability in Google's Brotli decoder. Cyber Kendra and The Hacker News both report that the proof of concept exploit successfully ran attacker-supplied code on an official Node.js build using crafted Brotli data. [1][2][3]

The vulnerability affects official releases including the Node.js 24.22.0 image for Linux arm64 without requiring a debugger or custom build, according to The Hacker News. Rescana and Aikido Security both report that the vulnerability is tracked as CVE-2026-111497. The Hacker News reports that the underlying flaw in the Brotli decoder also affects Bun, Python packages brotli and brotlicffi, and Envoy proxies configured for Brotli decompression. [2][3][6][7]

The incident occurs during a period in October 2026 known in information security as Black October. October 2026 earned the designation due to numerous major security incidents, vulnerability disclosures, and the increased application of artificial intelligence in security research. [8]

To mitigate the risk of exploitation, administrators must upgrade affected software installations. Rescana reports that organisations should update Node.js deployments to versions 22.23.4, 24.22.1, or 26.12.1. [7]