# Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE Exploit (CVE-2026-111497)

> Node2Shell is a working remote code execution exploit, demonstrated by Imperva, against the Brotli decoder bundled with Node.js 22.x, 24.x and 26.x (CVE-2026-111497). A crafted Brotli stream triggers an out-of-bounds write when Node.js decompresses attacker-controlled data, such as request bodies handled by body-parser or compressed responses consumed by fetch().

- **Published:** 2026-10-23T15:28:07Z
- **Last reviewed:** 2026-10-23T19:26:34.259Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4277
- **ID:** TL-2026-4277
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111497

## Description

CVE-2026-111497 is a high-severity memory-safety flaw in the Brotli decoder bundled with Node.js (the bug is in the bundled Google Brotli library, not Node.js's own code). Per the Node.js advisory of 2026-10-21, a crafted compressed stream that declares a single block type and then switches blocks was not rejected. Imperva describes the trigger as an invalid transition between block types that the stream structure should make impossible: instead of treating it as a format error, the vulnerable decoder treats it as a need for more input and keeps processing with a corrupted internal state, which allows out-of-bounds writes beyond buffer boundaries. Node.js applied the upstream fix (google/brotli commit 0ed4268a4401abcb4472096340477cf4af7d1a2b), which makes the decoder return a format error for the invalid transition and pass it to the caller.

Exposure: any application that decompresses Brotli data it does not control. The affected Node.js APIs are zlib.brotliDecompress(), its synchronous form, and zlib.createBrotliDecompress(). Node.js's built-in fetch() requests Brotli encoding from HTTPS servers by default and decodes responses through the same code path, so a malicious or compromised server can target Node.js clients. On the server side, middleware that decompresses incoming request bodies (Express and body-parser, via the raw() and json() parsers) is an exposed path.

Imperva's Red Team validated the issue and published a working RCE proof of concept (Node2Shell) on 2026-10-22. Code carried inside the Brotli data executed inside the target process in official Node.js 24.22.0 Linux arm64 containers without debugger instrumentation; the test application contained no code to create the marker file, yet the file appeared after it received the Brotli data. Tested targets were Express 5.0.0 with body-parser 2.0.1, Express 5.3.0 with body-parser 2.3.0, standalone body-parser 2.0.0, and the built-in fetch() with compressed HTTP responses. The proof did not succeed on every attempt, and Imperva's results establish code execution only for the tested Linux arm64 build and application setups. Node.js 24.22.1 rejected the identical inputs. Imperva notes the research follows its earlier PHP2Shell work on untrusted compressed data leading to code execution.

The flaw was fixed in the 2026-10-21 Node.js security release (22.23.4, 24.22.1, 26.12.1), which patched 10 vulnerabilities, 4 of them high severity. Docker images and AWS Lambda base images for the fixed versions were published on 2026-10-21 to 2026-10-22. Imperva has added dedicated WAF rules validated against the exploitation attempts it reproduced, and lists unexpected process exits during decompression and decoder errors as signals that may help prioritize investigation, while stating neither is a reliable stand-alone sign of exploitation.

No in-the-wild exploitation, named threat actor, or network infrastructure has been reported in the reviewed sources; a third-party aggregator states no public exploitation or PoC existed at the time of the release, which was before Imperva's 2026-10-22 publication. Status is ACTIVE because a public working PoC now exists. Sources disagree on the CVSS score (9.2 and 8.1 appear in third-party aggregators, while the Node.js advisory had published only a title and High rating, with no CVSS or CWE, at release), so the score is left unset. Out-of-bounds write corresponds to CWE-787. Third-party aggregators state that end-of-life lines (Node.js 20 reached end of life on 2026-04-30; 18.x, 23.x and 25.x are also reported EOL) will not receive patches, that systems linking an older system Brotli predating the upstream fix are also affected, and one aggregator describes the affected library range as Google Brotli 1.0.3 through 1.2.0 (not confirmed by the Node.js advisory).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1499 Endpoint Denial of Service

## Sources

- [New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data](https://cybersecuritynews.com/new-node2shell-node-js-rce-exploit/)
- [Imperva: Node2Shell - From Brotli Data to Remote Code Execution](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)
- [Node.js Security Release October 2026 (SecurityOnline)](https://securityonline.info/nodejs-security-release-october-2026/)
- [Patchstack: Out-of-bounds write in the bundled Brotli decoder leading to RCE (Node.js < 22.23.4)](https://patchstack.com/database/npm/plugin/nodejs/vulnerability/node-js-22-23-4-24-22-1-26-12-1-out-of-bounds-write-in-the-bundled-brotli-decoder-leading-to-remote-code-execution)
- [Konfirmity: Node.js October 2026 Security Releases](https://www.konfirmity.com/advisories/nodejs-october-2026-security-releases)
- [FourWeekMBA: Node.js Fixes 10 Flaws, 4 High, on the Same Day as PHP](https://fourweekmba.com/ai-node-js-fixes-10-flaws-4-high-on-the-same-day-as-php/)
- [google/brotli upstream fix commit 0ed4268](https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4277