Node2Shell: Imperva ran attacker code on the official Node.js 24.22.0 build with crafted Brotli data (CVE-2026-111497), through fetch() and Express 5 body parsers

confirmed research (Imperva Red Team, Oct 22; Node.js advisory Oct 21; no in-the-wild exploitation reported)2026-10-23

Node2Shell: Imperva ran attacker code on the official Node.js 24.22.0 build with crafted Brotli data (CVE-2026-111497), through fetch() and Express 5 body parsers

The Brotli decoder bug Node.js patched on Oct 21 (CVE-2026-111497, high, an out-of-bounds write) now has a working code-execution demo on a standard build. The first public PoC only got execution on a deliberately weakened build.

Imperva's Red Team ran code inside apps on the official Node.js 24.22.0 Linux arm64 image with no debugger or instrumented binary. It took several attempts in their setup, and other architectures and the 22.x/26.x lines weren't tested.
Two ways in: a Brotli-compressed response read through the built-in fetch(), and a Brotli-compressed request body decoded by Express 5.0.0-5.3.0 / body-parser 2.0.0-2.3.0 json() or raw(). A bare Node HTTP server doesn't decode Brotli request bodies by itself.
On 24.22.1 the same input was rejected and no code ran.

Do: move to 22.23.4, 24.22.1 or 26.12.1 or later, including Node binaries bundled in container images, Electron-style apps and CI runners. 20.x and older get no fix. Node.js lists no workaround, and WAF rules only cover inbound requests, not Brotli responses your services fetch.

Sources: Imperva: Node2Shell, from Brotli data to remote code execution (Oct 22) · Node.js: October 21, 2026 security releases · CERT Santé: Node.js CVE-2026-111497 (Oct 22)