# Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

**URL:** <https://forums.thehomestack.io/t/researchers-demonstrate-node2shell-rce-exploit-on-node-js-build-using-crafted-brotli-data/26578>\
**Category:** The Hacker News\
**Created:** [October 23, 2026, 7:57am UTC](https://forums.thehomestack.io/t/researchers-demonstrate-node2shell-rce-exploit-on-node-js-build-using-crafted-brotli-data/26578 "2026-10-23T07:57:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![robinhood1995](https://forums.thehomestack.io/letter_avatar_proxy/v4/letter/r/48db29/32.png) [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\
**Post date:** [October 23, 2026, 7:57am UTC](https://forums.thehomestack.io/t/researchers-demonstrate-node2shell-rce-exploit-on-node-js-build-using-crafted-brotli-data/26578/1 "2026-10-23T07:57:17Z")

</div>

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have&nbsp;demonstrated.

Their “Node2Shell” proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

* * *
This is a companion discussion topic for the original entry at [https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html](https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html)