VulnerabilitiesOct 22, 2026

Node2Shell: Node.js Brotli Flaw Gets RCE Proof of Concept

Node.js Brotli flaw CVE-2026-111497 allows RCE; patches released for multiple versions.

Vendor Watch

Run Imperva?

Get an email when a reviewed story names Imperva, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

Summary

Imperva researchers have detailed a remote code execution vulnerability in Node.js's Brotli decoder, dubbed Node2Shell. The flaw, CVE-2026-111497, allows attackers to execute arbitrary code by supplying specially crafted Brotli-compressed data. Node.js has released security updates (26.12.1, 24.22.1, and 22.23.4) to address this and nine other vulnerabilities, four of which are rated high severity.

What helps against this

How we list vendors

Imperva research

Automated patch management
Known holes get closed in days, not months.
For exampleMicrosoft Intune Qualys Patch Management NinjaOne Patch Management all options
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleSophos Endpoint CrowdStrike Falcon Insight XDR Microsoft Defender for Endpoint all options
Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
For exampleImperva Cloud WAF Cloudflare WAF and DDoS protection Akamai App & API Protector all options

Indicators of Compromise

cve — CVE-2026-111497
cve — CVE-2026-105483
cve — CVE-2026-106069
cve — CVE-2026-106072
cve — CVE-2026-105482
cve — CVE-2026-105481
cve — CVE-2026-106074
cve — CVE-2026-106073

Entities

Node.js (product)Brotli (product)Express (product)body-parser (product)Imperva (vendor)TLS (technology)