Node2Shell RCE Exploit Targets Node.js via Brotli Decoder Flaw

Introduction

Security researchers at Imperva have published a proof-of-concept exploit dubbed Node2Shell that achieves remote code execution on an official, unmodified Node.js 24.22.0 Linux arm64 image. The attack requires no debugger attachment, no custom runtime build, and no privileged access — only the ability to feed malicious Brotli-compressed data to the application. The underlying vulnerability resides in Node.js's bundled Brotli decoder and has been assigned CVE-2026-111497. Node.js maintainers have acknowledged the flaw and disclosed it publicly.

Technical Mechanics of the Node2Shell Exploit

The exploit chain centers on the Brotli decompression library that ships with Node.js by default. When an application processes attacker-controlled Brotli streams — a common scenario in APIs that accept compressed payloads, reverse proxies that decompress upstream responses, or build pipelines that handle artifacts — the crafted data triggers memory corruption in the decoder. Imperva's researchers showed that this corruption can be reliably steered to hijack control flow and execute arbitrary shellcode within the Node.js process context.

Critically, the demonstration targeted the official Node.js 24.22.0 Docker image for Linux arm64, meaning the vulnerability exists in the upstream release artifacts distributed by the Node.js project itself. No patched or hardened variant was used. The exploit does not rely on V8 JIT bugs, WebAssembly edge cases, or native add-ons; it weaponizes a core dependency that many teams assume is safe because it is maintained by the Node.js project.

Impact Assessment and Affected Surface

Any Node.js service that decompresses untrusted Brotli data is potentially exposed. High-risk scenarios include:

• Public APIs that accept Content-Encoding: br request bodies
• Edge functions and serverless platforms that automatically decompress incoming payloads
• CI/CD pipelines that process Brotli-compressed artifacts from external sources
• Reverse proxies or API gateways implemented in Node.js that decompress upstream responses before forwarding

The arm64 architecture is explicitly confirmed vulnerable in the 24.22.0 release. Given that the Brotli decoder is shared across platforms, other architectures and versions that bundle the same decoder version are likely affected until patched. Organizations running Node.js 24.x on arm64 — increasingly common in cloud environments using Graviton, Ampere, or Apple Silicon runners — should treat this as an active threat.

Detection and Immediate Mitigation Steps

Until an official Node.js security release lands, defenders should consider the following layered mitigations:

• Disable Brotli decompression for untrusted input. Configure middleware (e.g., Express body-parser, Fastify fastify-compress) to reject or skip br encoding from external clients.
• Enforce strict content-type and size limits. Reject compressed payloads exceeding a small threshold (e.g., 1 MB) before they reach the decoder.
• Deploy a WAF or runtime application self-protection (RASP) rule that inspects incoming Content-Encoding headers and blocks or sanitizes Brotli streams.
• Pin to a known-good Node.js version that predates the vulnerable decoder, or build from source with an updated Brotli library (v1.1.0 or later, once confirmed patched).
• Monitor for anomalous process behavior: unexpected child processes, network connections from the Node.js worker, or crashes in the decompression path.

Supply-chain scanners and SBOM tools should flag the bundled Brotli version in your Node.js runtime image. Treat the runtime itself as a supply-chain component requiring patch management, not just your application dependencies.

Conclusion

The Node2Shell demonstration proves that a single flawed decoder in the Node.js runtime can bypass the entire application security stack. Organizations should immediately audit where Brotli decompression occurs in their attack surface, apply the mitigations above, and track the official Node.js security advisory for a patched release. Grivyonx's AI-driven DevSecOps platform helps teams continuously inventory runtime components, detect vulnerable decoder versions in container images, and enforce decompression policies across CI/CD pipelines and production workloads.