A Node.js flaw lets attackers hack apps with nothing more than compressed data

On October 22, Ron Masas, a researcher at security vendor Imperva, published an account of an experiment that is simple to summarize. He sent deliberately malformed Brotli-compressed data to a Node.js application, and the application executed the code it carried. The test succeeded on the official Node.js 24.22.0 image for Linux. On the next version, 24.22.1, the same data was rejected.

The day before, on October 21, the Node.js project had released security updates for its three maintained branches: 22.23.4, 24.22.1 and 26.12.1. They fix ten vulnerabilities, including this one, tracked as CVE-2026-111497 and rated "high" severity by Node.js. Singapore's cybersecurity agency, which relayed the alert on October 23, gives it a score of 9.8 out of 10. As of October 23, no real-world attack had been reported.

An eight-byte buffer that overflows

Brotli is a compression format designed by Google and widely used to slim down web pages. Node.js, the environment that runs JavaScript on a very large number of servers, ships with a copy of the Brotli decoder. That decoder is the culprit.

According to the Node.js advisory, an invalid instruction in the compressed stream was not treated as an error: the decoder simply believed it was waiting for more data. It kept adding the bytes it received to an internal eight-byte buffer, until it wrote past its end. An attacker who can supply Brotli data that an application decompresses with the node:zlib module can therefore corrupt the program's memory. According to Node.js, this can cause a crash, disclosure of the process's memory, or remote code execution.

The advisory credits the discovery to OpenAI's Codex Security team (Khai Tran and Sylvie Mayer). Imperva has dubbed the flaw "Node2Shell." The name echoes PHP2Shell, the pair of critical PHP vulnerabilities that has kept administrators busy since October 21 (see our article).

Which applications are really exposed?

Not all of them. A bare Node.js HTTP server does not decompress incoming Brotli data on its own, Imperva stresses. The risk appears when the application, or a library it uses, decodes data coming from outside. Imperva achieved code execution in two situations:

• with Node.js's fetch() function, when it receives a Brotli-compressed response sent by a malicious server: in that case, the client application is the target;
• with incoming requests decompressed by the Express framework (versions 5.0.0 to 5.3.0) or by the body-parser module (versions 2.0.0 to 2.3.0), through the raw() and json() parsers.

Imperva notes that code execution did not succeed on every attempt and that it did not test all versions. The defect lies in the Brotli library itself, fixed in versions 1.0.10, 1.1.1 and 1.2.1, so other software that embeds it may also need updating. The site Cyber Kendra notably cites Bun, a Node.js competitor, fixed in version 1.4.4.

What to do

The patch has been available for four days. The difficulty, as is often the case, is finding every place where Node.js is installed.

• Update Node.js to version 22.23.4, 24.22.1 or 26.12.1, or a later one. Updating npm packages is not enough: Node.js itself must be replaced.
• Check the version actually present in your container images, serverless functions, command-line tools, desktop applications and continuous integration machines. A package inventory can miss these copies, Imperva warns.
• Move off unmaintained versions: Node.js 20 and earlier versions will not receive a patch.
• In the meantime, limit Brotli data coming from outside. For incoming requests, body-parser's inflate: false option rejects compressed bodies, the firm Rescana points out. A web application firewall is only a stopgap: Vercel's, for example, does not cover the responses your functions fetch from other servers, according to Rescana.

The same update also fixes two high-severity flaws that, in some cases, make Node.js validate the certificate of a different IP address than the one it contacted. It also refreshes the list of trusted certificates, after the compromise of an eMudhra intermediate authority (read our article). All the more reasons not to put this update off. What remains to be seen is when a reliable exploit will start circulating: it is now a race between that exploit and the updates.