Node.js patches Node2Shell flaw after researchers demonstrate code execution
Node.js released fixes on 21 October for CVE-2026-111497, an out-of-bounds write in its bundled Brotli decoder that can crash a process, expose memory or potentially allow remote code execution. Imperva demonstrated code execution against the official Node.js 24.22.0 Linux arm64 build; the fixed 24.22.1 release rejected the same inputs. The flaw is reachable when an application decompresses Brotli data controlled by an attacker.
Bottom line — Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1; Node.js 20 and older are end of life and will not receive a fix.
Go deeper 6
-
Imperva tested incoming compressed request bodies and Brotli responses consumed by fetch(); both reach the vulnerable decoder.
-
Express 5 and body-parser 2 can decompress incoming Brotli request bodies when configured to parse them.
-
The Hacker News reported that a public proof of concept reached code execution only on a deliberately weakened test build; Imperva’s separate lab exploit worked on the official 24.22.0 image.
-
Rescana reported that no exploitation in the wild had been reported as of 23 October, and the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalogue.
-
Aikido notes that Bun was also affected before version 1.4.4; Linux distribution builds using system Brotli may need their distribution’s Brotli package updated.
-
Imperva and Vercel say temporary limits on untrusted Brotli traffic can reduce exposure, but do not protect against vulnerable runtimes decompressing fetched responses.
www.amazon.com