Critical Brotli Flaw Lets Attackers Run Code on Node.js Servers
A buffer overflow in the Brotli decoder, bundled with Node.js, scores 9.2 on the severity scale. Researchers already have a working exploit.
Key points
- Imperva researchers built a working exploit, called Node2Shell, that runs attacker code on an unmodified official Node.js 24.22.0 Linux image by feeding it crafted Brotli data.
- The underlying bug, CVE-2026-111497, is a buffer overflow in Google's Brotli decoder rated 9.2 out of 10 and published on 22 October 2026.
- Every Brotli release from 1.0.3 through 1.2.0 is vulnerable; fixed versions are 1.0.10, 1.1.1 and 1.2.1.
- Node.js shipped patches for its 26.x, 24.x and 22.x release lines on the same day, alongside fixes for OpenSSL, SQLite, c-ares and Undici.
- The flaw needs no login and no user interaction: any server that decompresses attacker-controlled Brotli data is in scope.
A critical hole in the compression code bundled with Node.js can let a remote attacker take over a server by sending it a specially crafted blob of data. The flaw sits in Brotli, a widely used compression format developed by Google, and it affects a huge span of versions used across the web.
Google's advisory for CVE-2026-111497 describes a buffer overflow in the Brotli decoder, meaning the software can be tricked into writing data past the end of a memory region it was allowed to touch. From there an attacker can read sensitive memory, crash the process, or run their own code. No password or account is needed. A single malicious compressed stream is enough.
Researchers at Imperva turned that theory into a working attack. Their proof of concept, which they call Node2Shell, runs attacker-supplied code on the official Node.js 24.22.0 Linux arm64 image, with no debugger attached and no custom build. The Hacker News first reported the demonstration. In plain terms: a stock Node.js server, pulled straight from the official download, can be made to execute commands by feeding it a crafted Brotli payload.
What should admins do right now?
Update Node.js, and update any standalone Brotli libraries. The Node.js project published fixes on 22 October 2026 for its 26.x, 24.x and 22.x release lines. If you build your own binaries against Brotli, move to 1.0.10, 1.1.1 or 1.2.1. Anything from 1.0.3 up to 1.2.0 is exposed.
The same Node.js release also closes three other high-severity bugs worth flagging:
| CVE | What it does | Affected lines |
|---|---|---|
| CVE-2026-105482 | DNS resolver truncates names at a NUL character | 26.x, 24.x, 22.x |
| CVE-2026-105483 | TLS hostname check bypass using fullwidth digits | 26.x, 24.x |
| CVE-2026-106069 | TLS hostname check bypass via loose IP resolution | 26.x, 24.x, 22.x |
How bad is this in practice?
Bad, because Brotli decoding happens in places developers rarely think about. Browsers negotiate it. Web servers decompress request bodies with it. Reverse proxies and API gateways handle it on the way in. Any Node.js service that accepts a Brotli-encoded request, or fetches Brotli-encoded content from somewhere an attacker can influence, is a candidate target.
The severity score of 9.2 reflects that reach. Remote. Unauthenticated. Potentially full code execution. The usual pattern after a public proof of concept is a short gap, then opportunistic scanning. Imperva has shown the exploit works on the official image. Others will catch up.
One reporter's read: the headline risk here is not Node.js itself but the long tail of containers, serverless functions and appliances that bundle an older Brotli and will not get patched for weeks. Watch for vendor advisories from anyone shipping a Node.js runtime inside a product.
What should ordinary users do?
Nothing directly. This is a server-side bug. The practical fallout, if operators do not patch quickly, is the usual one: breached web services, leaked account data, and breach-notification letters landing in inboxes some months from now.
