---
title: Node2Shell: Imperva ran attacker code on the official Node.js 24.22.0 build with crafted Brotli data (CVE-2026-111497), through fetch() and Express 5 body parsers | ctxsec
url: https://ctxsec.com/items/node2shell-imperva-rce-official-node-24-22-0
description: ""
status: "confirmed research (Imperva Red Team, Oct 22; Node.js advisory Oct 21; no in-the-wild exploitation reported)"
published: 2026-10-23
---

> 

[← Cybersecurity News](/news) · [markdown](/items/node2shell-imperva-rce-official-node-24-22-0.md)

confirmed research (Imperva Red Team, Oct 22; Node.js advisory Oct 21; no in-the-wild exploitation reported)

2026-10-23

### Node2Shell: Imperva ran attacker code on the official Node.js 24.22.0 build with crafted Brotli data (CVE-2026-111497), through fetch() and Express 5 body parsers

The Brotli decoder bug Node.js patched on Oct 21 (**CVE-2026-111497**, high, an out-of-bounds write) now has a working code-execution demo on a **standard** build. The first public PoC only got execution on a deliberately weakened build.

- Imperva's Red Team ran code inside apps on the **official Node.js 24.22.0 Linux arm64 image** with no debugger or instrumented binary. It took several attempts in their setup, and other architectures and the 22.x/26.x lines weren't tested.
- **Two ways in:** a Brotli-compressed **response** read through the built-in `fetch()`, and a Brotli-compressed **request body** decoded by Express 5.0.0-5.3.0 / body-parser 2.0.0-2.3.0 `json()` or `raw()`. A bare Node HTTP server doesn't decode Brotli request bodies by itself.
- On **24.22.1** the same input was rejected and no code ran.

**Do:** move to 22.23.4, 24.22.1 or 26.12.1 or later, including Node binaries bundled in container images, Electron-style apps and CI runners. 20.x and older get no fix. Node.js lists no workaround, and WAF rules only cover inbound requests, not Brotli responses your services fetch.

Sources: [Imperva: Node2Shell, from Brotli data to remote code execution (Oct 22)](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/) · [Node.js: October 21, 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) · [CERT Santé: Node.js CVE-2026-111497 (Oct 22)](https://cyberveille.esante.gouv.fr/alertes/nodejs-cve-2026-111497-2026-10-22)