Skip to content
Hacker Posts

Node.js patches Brotli decoder RCE (CVE-2026-111497); PoC public

Node.js fixed CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that Imperva turned into an RCE PoC ('Node2Shell'). Lines 22.x, 24.x and 26.x are affected.

Published 3 min read
cvenodejsrcebrotli

Node.js shipped a fix on October 21 for CVE-2026-111497, a high-severity out-of-bounds write in the Brotli decoder bundled with the runtime. The authoritative source is the Node.js October 2026 security release; Imperva has since published a working proof of concept it calls Node2Shell, covered by The Hacker News on October 23. If you decode Brotli-compressed data on any current Node.js line, patch.

What the bug does

Per Imperva's analysis, the decoder mishandles a block-type change that the Brotli stream's own structure rules out. Instead of rejecting it, the decoder treats it as a request for more input and keeps decoding in an invalid state; a memory-sanitizer run showed an out-of-bounds write. Imperva's Node2Shell PoC ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64, with no debugger and no custom build — though they note it "did not succeed on every attempt" and took several tries.

Where you'd meet it

The dangerous paths are where untrusted Brotli data reaches the decoder:

  • fetch() responses — Node.js's built-in fetch() decompresses Brotli (content-encoding: br), so a malicious or compromised upstream server can deliver the crafted stream to a client making the request.
  • Request bodies — middleware that decodes Brotli request bodies. Imperva tested Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0.

Affected and fixed versions

The advisory lists lines 26.x, 24.x and 22.x as affected. Fixed releases:

  • Node.js 22.23.4
  • Node.js 24.22.1
  • Node.js 26.12.1

Lines 20.x and earlier do not receive this fix and should be moved to a supported release.

Exploitation status

No in-the-wild exploitation had been reported as of October 22 — this is a researcher PoC, not an active campaign. Vercel added WAF rules on October 21, but Imperva notes those don't cover Brotli responses fetched from other servers.

Action checklist

  1. Upgrade to 22.23.4, 24.22.1 or 26.12.1 (or later). This is the fix; there is no in-runtime workaround.
  2. Get off EOL lines. If you're on 20.x or earlier, migrate to a supported line — no patch is coming.
  3. Inventory your Brotli surface. Flag services that call fetch() against third-party endpoints and any middleware decoding Brotli request bodies (Express/body-parser in the ranges above).
  4. Where upgrade lags, limit or strip untrusted Brotli traffic on exposed paths as an interim control.

Context

The interesting part is the delivery path. An out-of-bounds write in a decompressor is an old shape of bug; what makes CVE-2026-111497 broadly reachable is that Node's own fetch() enables Brotli by default, so a server doesn't have to be attacked to be exposed — it just has to make a request to the wrong place. As runtimes bundle more "batteries included" networking, the client side of HTTP keeps becoming attack surface. Patch the runtime; don't wait for a reliable public exploit to make the decision for you.

Related stories