Node2Shell RCE hits official Node.js build via crafted Brotli data

Imperva demonstrated Node2Shell, an exploit that runs attacker code on the official Node.js 24.22.0 image for Linux arm64 by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js has disclosed the flaw.

• Exploit worked on the official Node.js 24.22.0 Linux arm64 image
• Attack abuses malicious Brotli data via CVE-2026-111497
• Code execution needs no debugger or custom build