Node2Shell RCE in Node.js: Which Apps Are at Risk and What to Patch

A security flaw in Node.js can turn malicious compressed data into remote code execution (RCE). Researchers have demonstrated the attack against an unmodified runtime, raising concerns for applications that process untrusted Brotli data.

Imperva disclosed its Node2Shell proof of concept on October 22, 2026, demonstrating code execution on Node.js 24.22.0 running Linux arm64. Tracked as CVE-2026-111497, the vulnerability affects Node.js release lines 22, 24, and 26. Security fixes were released October 21.

Applications using Express middleware or Node.js's built-in fetch() API may encounter the vulnerable decoder without directly invoking it. Exposure depends on whether attacker-controlled Brotli data reaches the affected code.

Node2Shell exposure extends beyond custom decompression code

Node2Shell exploits an out-of-bounds write in Node.js's bundled Brotli decoder. Malformed compressed input can corrupt memory, potentially causing crashes, information disclosure, or code execution. Related memory-safety risks have also prompted OpenSSL security updates, although the vulnerabilities have different mechanisms.

Akamai's October 26 analysis reports a CVSS v4.0 score of 9.2 (critical), while Node.js rates the flaw as high severity.

According to Imperva's research, exposure can occur through three paths:

• Express 5 middleware: Configured request parsers can decompress Brotli-encoded request bodies.
• Node.js fetch(): Applications can decompress malicious Brotli responses from untrusted servers.
• node:zlib: Services directly decompressing attacker-controlled Brotli streams can reach the vulnerable decoder.

“The bug is implementation-specific and does not affect every server running Node.js out of the box,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr.

Ganchev warned that dependencies may introduce overlooked decompression paths. Similar dependency risks surfaced in a WordPress HEIC upload vulnerability, where image-processing software could expose servers to RCE.

Imperva's Linux arm64 demonstration required multiple attempts. The researchers did not establish comparable exploit reliability on other platforms, although the underlying vulnerability is not limited to Linux arm64.

Patched Node.js versions and mitigation priorities

The Node.js security advisory identifies these fixed releases:

Organizations should install the applicable patched release or newer fixed version. Unsupported installations require migration to supported branches. Updating Express or body-parser alone does not fix the runtime flaw.

Security teams should prioritize six measures:

• Inventory exposed applications: Check Node.js versions across servers, containers, and serverless workloads. Identify Express, fetch(), and node:zlib decompression paths.
• Patch and verify deployments: Upgrade runtimes, rebuild affected container images, and confirm production processes use patched binaries.
• Disable unnecessary decompression: Set Express body-parser's inflate option to false where compressed request bodies are unnecessary.
• Restrict untrusted traffic: Temporarily block inbound Content-Encoding: br requests where appropriate and limit unnecessary outbound connections. Inbound filtering does not protect fetch() responses.
• Limit potential compromise: Segment services and restrict application privileges, filesystem access, and cloud credentials.
• Monitor and test incident response plans: Investigate unexplained crashes, decompression errors, unexpected child processes, and suspicious connections. Correlate application and network logs, and test incident response plans.

Perimeter filtering provides only temporary protection. Previous PeopleSoft WAF bypass attacks demonstrated how vulnerable systems can remain exposed when filtering replaces patching.

Ganchev recommended investigating logs containing “Decompression failed,” although such errors do not prove exploitation. Security teams should identify applications processing untrusted Brotli data and verify that patched Node.js runtimes are running in production.

Read more: GitLab's second critical RCE patch in October demonstrates why administrators must continue checking security releases, even after applying earlier fixes.