vuln2shell

CatalogNode2Shell

Node2Shell (CVE-2026-111497)

Shared component node2shell

Out-of-bounds write in the Brotli decoder bundled with Node.js that can permit remote code execution when attacker-controlled Brotli data is decompressed. Google rates CVSS 4.0 9.2. Node.js rates it High. Imperva Red Team demonstrated code execution on the official Node.js 24.22.0 image. Not in CISA KEV as of 23 Oct 2026.

Patched
Aliases
CVE-2026-111497, Node 2 Shell
Published
Updated

What the bug is

Node2Shell is Imperva Red Team's name for CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder as bundled with Node.js. Node.js disclosed it on 21 Oct 2026 in the Wednesday security releases and rates it High. NVD lists Google's CVSS 4.0 score of 9.2.

A Node.js service can hit the decoder when it consumes a Brotli response (including via fetch()) or when middleware such as Express 5 / body-parser 2.x inflates an incoming Content-Encoding: br body. Crafted Brotli streams can corrupt decoder state, disclose memory, crash the process, or potentially execute code.

Fixed Node.js releases are 22.23.4, 24.22.1, and 26.12.1. Bun is fixed in 1.4.4. End-of-life Node.js lines (20.x, 23.x, 25.x and older) receive no fix. Google Brotli 1.0.3 through 1.2.0 is the stated affected range; branch-specific fixed releases include 1.0.10, 1.1.1, and 1.2.1.

Attack path

  1. Untrusted BrotliAttacker-controlled Brotli data reaches Node.js via a compressed response, an inflated request body, or a direct zlib call.
  2. Decoder flawThe bundled Brotli decoder continues past an invalid stream condition and writes out of bounds.
  3. Memory corruptionAdjacent decoder state is corrupted. Memory disclosure or process crash can follow.
  4. Code execNode.js says the out-of-bounds write can permit remote code execution. Imperva showed code running on Node.js 24.22.0. Conceptual impact class only.

High-level only. Not a reproduction guide.

Exploitation status

CISA KEV

Not in CISA KEV as of .

CISA KEV catalog

Last verified 23 Oct 2026 against CISA KEV catalog 2026.10.21. CVE-2026-111497 is not listed.

First seen

No first-seen source recorded.

No authoritative source reports in-the-wild exploitation as of 23 Oct 2026. Imperva validated RCE in a lab on the official Node.js 24.22.0 image.

What defenders should do today

Do today

  1. 1

    Upgrade Node.js

    Move to 22.23.4, 24.22.1, or 26.12.1 (or a later fixed release in the same line). Rebuild and redeploy container images that pin older tags. End-of-life lines (20.x, 23.x, 25.x and older) get no fix; upgrade to a supported line.

    Node.js security releases

  2. 2

    Upgrade Bun if used

    Bun users should upgrade to 1.4.4 or newer.

    Aikido Node2Shell guidance

This week

  1. 1

    Limit untrusted Brotli paths while patching

    Where practical, reject inbound Content-Encoding: br before request-body decompression, or disable Brotli request inflation. Restrict fetch() of untrusted Brotli responses. Filtering does not replace patching.

    Imperva Node2Shell post

  2. 2

    Check distribution Brotli packages

    Linux distro packages of Node.js may use the system Brotli library. Apply the distribution Brotli update as well as the Node.js version bump.

Detection rules

Sigma

  • Linux Shell Spawned By Node.js Process

    Log source: Linux process creation (Sysmon for Linux 1 / auditd)

    title: Linux Shell Spawned By Node.js Process
id: 5a1805d1-834c-574d-97be-837f7dcff9f8
status: experimental
description: Hunts for a Unix shell started directly by a Node.js process. Imperva showed CVE-2026-111497 (Node2Shell) running attacker-supplied code inside the Node.js process, so new shells under node on servers that never shell out are worth a look.
references:
    - https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
    - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
author: vuln2shell
date: 2026-10-23
tags:
    - attack.execution
    - attack.t1059.004
    - cve.2026-111497
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: '/node'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
    condition: selection
falsepositives:
    - Node.js applications, build tools and package scripts that legitimately run shell commands
level: medium

    By vuln2shell, . Source. License: CC0 1.0

    Written by vuln2shell. Untested, tune before use.

    Generic post-exploitation hunt grounded in Imperva's code-execution finding. Baseline first; many Node.js apps shell out.

SPL (Splunk)

  • Node.js process crashes on Linux hosts

    Log source: Linux kernel / syslog / journald

    (sourcetype=syslog OR sourcetype=journald OR sourcetype=linux_messages_syslog) "segfault" TERM(node)
| stats count min(_time) as firstTime max(_time) as lastTime by host
| sort - count

    By vuln2shell, . Source. License: CC0 1.0

    Written by vuln2shell. Untested, tune before use.

    Imperva notes unexpected process exits during decompression may help prioritise investigation but are not a stand-alone sign of exploitation. Correlate with Node.js version and Brotli traffic.

KQL (Microsoft Sentinel / Defender)

  • Devices with CVE-2026-111497 in Defender Vulnerability Management

    Exposure check

    Log source: Microsoft Defender Vulnerability Management (DeviceTvmSoftwareVulnerabilities)

    DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-111497"
| project DeviceName, OSPlatform, SoftwareVendor, SoftwareName, SoftwareVersion, VulnerabilitySeverityLevel

    By vuln2shell, . Source. License: CC0 1.0

    Written by vuln2shell. Untested, tune before use.

    Exposure query in the same form Microsoft publishes for other CVEs. Returns nothing until MDVM maps this CVE; Imperva warns package inventories can miss Node.js binaries bundled in containers.

LogScale (CrowdStrike)

  • Shell spawned by a Node.js process (Falcon)

    Log source: CrowdStrike Falcon ProcessRollup2 (Linux)

    #event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=node
| FileName=/^(sh|bash|dash)$/i
| groupBy([aid, ComputerName, FileName, CommandLine], limit=max)

    By vuln2shell, . Source. License: CC0 1.0

    Written by vuln2shell. Untested, tune before use.

    Same logic as the Sigma rule above. Baseline first.

Suricata / Snort

  • Inbound HTTP request with a Brotli Content-Encoding (exposure mapping)

    Exposure check

    Log source: Suricata HTTP inspection (needs decrypted HTTP)

    alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VULN2SHELL HUNTING Inbound HTTP request with Content-Encoding br (CVE-2026-111497 exposure mapping)"; flow:established,to_server; http.header; content:"Content-Encoding|3a 20|br|0d 0a|"; nocase; reference:cve,2026-111497; reference:url,www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/; classtype:misc-activity; sid:1000001; rev:1;)

    By vuln2shell, . Source. License: CC0 1.0

    Written by vuln2shell. Untested, tune before use.

    Imperva says untrusted Brotli request bodies reach the vulnerable decoder via Express 5 / body-parser 2. This finds where such traffic arrives; it is not an exploit signature. Local sid; renumber to fit your local range.

More detection content

Vendor signatures

Vendor signatures
SignalLog sourceWhat to look for
Imperva WAF rules for CVE-2026-111497WAF / IPS event logsImperva states it added WAF rules for CVE-2026-111497.

Affected products

Products that share Google Brotli decoder (bundled with Node.js / Bun)

Distro packages of Node.js may link the system Brotli library. Check both the Node.js version and the Brotli package.

Downstream product matrix
ProductStatusFixed version / ETAAdvisoryNotes
Containers, cloud, CDN & hosting platforms6
Google Brotli libraryGoogleAffected1.0.10 / 1.1.1 / 1.2.1

22 Oct 2026

Source
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Node.js 20.x / 23.x / 25.x (EOL)Node.js ProjectAffectedNo fix (upgrade to a supported line)

21 Oct 2026

Source
It's important to note that End-of-Life versions are always affected when a security release occurs.
Upgrade to 22.23.4, 24.22.1, or 26.12.1.
Node.js 22.xNode.js ProjectAffected22.23.4

21 Oct 2026

Source
Affects Node.js 26.x, 24.x, and 22.x. Fixed in Node.js v22.23.4.
Node.js 24.xNode.js ProjectAffected24.22.1

21 Oct 2026

Source
Affects Node.js 26.x, 24.x, and 22.x. Fixed in Node.js v24.22.1.
Node.js 26.xNode.js ProjectAffected26.12.1

21 Oct 2026

Source
Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high). Downloads: Node.js v26.12.1.
BunOvenAffected1.4.4

22 Oct 2026

Source
For Bun, upgrade to 1.4.4 or newer.

Timeline4

Key events

Newest first.

  1. Disclosure

    NVD publishes CVE-2026-111497 with Google CNA CVSS 4.0 score 9.2.

    Source
  2. PoC

    Imperva Red Team publishes Node2Shell analysis and confirms RCE on Node.js 24.22.0.

    Source
  3. Advisory

    Aikido publishes defender-oriented Node2Shell guidance covering Express, fetch(), and Bun.

    Source
  4. Patch

    Node.js publishes security releases 22.23.4, 24.22.1, and 26.12.1, disclosing CVE-2026-111497.

    Source
Full timeline (4)
Thu 22 Oct 20263
  1. Disclosure

    NVD publishes CVE-2026-111497 with Google CNA CVSS 4.0 score 9.2.

    Source
  2. PoC

    Imperva Red Team publishes Node2Shell analysis and confirms RCE on Node.js 24.22.0.

    Source
  3. Advisory

    Aikido publishes defender-oriented Node2Shell guidance covering Express, fetch(), and Bun.

    Source
Wed 21 Oct 20261
  1. Patch

    Node.js publishes security releases 22.23.4, 24.22.1, and 26.12.1, disclosing CVE-2026-111497.

    Source

News & write-ups

Vendor1

PoC index (for defenders)

Public proof-of-concept links for defensive validation, with a source and a validation status.

No public PoC repository is indexed here. Imperva Red Team states it built a standalone proof of concept that ran code on the official Node.js 24.22.0 Linux arm64 image and published a demo video; the exploit code itself is not published as a repo link on that post.

Open questions

No open questions recorded.

Original research

Email alerts coming soon

We’re not sending mail yet. Follow the catalog with RSS or the JSON feed.

Email alerts unavailable

Email signup is disabled until a mail provider is configured.

RSSJSON feed