Node2Shell, Explained: Your Questions About the Node.js Compression Bug That Researchers Just Turned Into Code Execution
Researchers at Imperva got a booby-trapped piece of compressed data to run their code on an official Node.js build. The bug is fixed in updates released October 21, there is no workaround, and nothing has been seen in the wild yet. Here are the plain answers for business owners and the people who run their apps.
When Node.js shipped security updates on Wednesday, October 21, the most serious fix was for a bug in the code that unpacks Brotli-compressed data. Within a day, researchers showed it is more than a theoretical crash. Here is what you need to know, in question-and-answer form.
Our answers are based on The Hacker News’ report on the Node2Shell demonstration and its earlier coverage of the Node.js updates.
What is Node.js, and why should a business owner care?
Node.js is the engine behind a huge share of websites, customer portals, internal tools and APIs. If a developer or vendor built you a modern web app, there is a fair chance it runs on Node.js, sometimes tucked inside a container image where nobody thinks to look.
What exactly is the bug?
It is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles. Brotli is Google’s compression format, widely used on the web. Fed a stream crafted to reach a state its own structure rules out, the vulnerable decoder kept going instead of stopping, and wrote past the edge of a memory buffer. Node.js rates it high rather than critical, while describing remote code execution as the possible outcome.
What did the researchers actually prove?
Imperva’s proof of concept, which it calls Node2Shell, ran attacker-supplied code on the official Node.js 24.22.0 image for Linux on arm64, with no debugger or custom build. It did not work every time and took several attempts. Imperva did not test other processor architectures or the 22.x and 26.x lines. On the fixed 24.22.1 release, the same data was rejected. An earlier public proof of concept only achieved code execution on a deliberately weakened test build.
How would an attacker reach it?
From either direction of a web conversation. An app that downloads a Brotli-compressed response with Node’s built-in fetch() decodes it. So does an app using Express 5 body parsers, such as express.json(), which now decode Brotli request bodies along with gzip and deflate. Imperva reproduced the attack both ways, testing Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0. A plain Node.js server does not decode a Brotli body just by receiving it.
Is anyone exploiting it?
No exploitation in the wild had been reported as of October 22.
Which versions fix it?
- Node.js 22.23.4, 24.22.1 and 26.12.1, released October 21
- Versions 20.x and earlier are end of life and get no fix. Move them to a supported line.
- The Brotli library itself was fixed in 1.2.1, 1.1.1 and 1.0.10, so other software that bundles Brotli may need updates too.
Is there a workaround?
Not inside Node.js. Imperva suggests limiting untrusted Brotli traffic on affected paths where practical, but says only the update removes the flaw. Vercel added firewall rules on October 21 that block the attack in incoming requests, though they do not cover Brotli responses an app fetches from elsewhere.
Anything else in the same update?
Yes. The releases fix 10 flaws in total, including two high-rated TLS certificate-check bypasses, and stop Node.js from trusting eight intermediate certificate authority keys from the Indian provider eMudhra that were reported compromised.
What this means for your company
Ask your developers or software vendors three questions: which of our apps run on Node.js, which version, and when will each be on 22.23.4, 24.22.1, 26.12.1 or later? Make sure the answer covers container images and build servers, not just the code repository, because a bundled runtime is easy to miss. Anything still on Node.js 20 or older needs a migration plan, since it will not be patched. A web application firewall can buy time on incoming traffic, but it is a layer, not the fix.
Need help finding every place your business runs Node.js and getting it patched without breaking your apps? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
