Node.js Brotli RCE Demonstrated On Standard Build (CVE-2026-111497)

At a glance

Severity	CRITICAL
CVSS	CVE-2026-111497: 9.2
In CISA KEV (exploited)	No
Vendor	Linux
CVE IDs	CVE-2026-111497

A Node.js vulnerability in the bundled Brotli decoder, CVE-2026-111497 (CVSS 4.0 score 9.2), now has a working code-execution demonstration on a standard build, according to The Hacker News. Imperva researchers ran code on the official Node.js 24.22.0 image for Linux arm64. Node.js released fixes on October 21, and no exploitation in the wild had been reported as of October 22.

The flaw is not listed in CISA KEV and no EPSS data is available in our sources, so there is no federal remediation deadline. Treat it as a priority patch for any service that decodes untrusted Brotli data.

What happened

NVD describes a buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli 1.0.3 through 1.2.0. A remote, unauthenticated attacker can send a crafted Brotli stream to corrupt adjacent decoder state, disclose memory, cause a denial of service, or potentially execute arbitrary code.

The first public proof of concept only reached code execution on a deliberately weakened test build. On a normal build its author reported a crash and a limited read of process memory. Imperva’s “Node2Shell” demonstration goes further: it ran attacker-supplied code on an unmodified official build, with no debugger or custom build.

Imperva’s attack did not succeed every time. In its Linux arm64 setup, code execution took several attempts.

Am I affected?

Per the report, the decoder is bundled with Node.js, so applications on the 22.x, 24.x and 26.x lines are affected, not only the build Imperva tested. A service reaches the decoder in two ways:

It reads a Brotli-compressed response through Node.js’s built-in fetch().
Middleware decodes a Brotli-compressed request body. Express 5 body parsers such as express.json(), express.urlencoded(), express.text() and express.raw() now do this when applied to a route.

A plain Node.js HTTP server does not decode a Brotli request body just by receiving one; decoding needs middleware or an explicit call. Imperva reproduced code execution through both the request-body and response paths, testing Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 at pinned versions, and did not test every release in between.

Standalone Brotli users are also exposed: NVD lists Google Brotli 1.0.3 through 1.2.0 on all platforms. Lines 20.x and earlier are end-of-life; whether they are affected is not disclosed in the material we have.

Technical details

Weakness: CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value).
Attack vector: network, low complexity, no privileges and no user interaction (CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N).
Cause: Imperva traced it to an impossible point in a Brotli stream. The stream announces the block types it will use, and the test input reached a block change the stream’s own structure ruled out. The vulnerable decoder treated that as a request for more input and kept going in an invalid state. In a separate test with a memory sanitizer, continuing from that state wrote past an intended buffer.
Fix: Node.js imported an upstream Brotli patch that makes the decoder stop with a format error at that point. On the fixed release 24.22.1, the same data was rejected and no code ran.
Exploitation status: public proof of concept exists; no in-the-wild exploitation reported as of October 22.

Why this matters

Analysis, not new facts. Many Node.js services sit behind Express and accept JSON bodies from the internet, so the practical question is whether Brotli request decoding is reachable. Outbound fetch() calls to servers you do not control are a second path, because a malicious or compromised server can return a crafted response. Reliability looks limited today, since the demonstration needed several attempts and covered one architecture, but public proofs of concept tend to improve. Plan to patch on a normal accelerated cycle for exposed services rather than waiting for a routine window.

How to detect exposure

Inventory Node.js versions across servers and, importantly, container images and other artifacts that bundle a Node binary. A package inventory can miss these.
Search code and dependencies for Express 5 body parsers and for fetch() calls to untrusted hosts.
Hunt for unexplained Node.js process crashes or restarts, and for inbound requests with a Brotli Content-Encoding (br) on endpoints that should not need it. These are hunting ideas that follow from the report, not published indicators; no IOCs have been disclosed.

What to do

Update Node.js to a patched release. 24.22.1 is confirmed fixed; check the Node.js October 2026 security release notes for the fixed versions on your 22.x or 26.x line.
If you use Google Brotli directly, move to 1.0.10, 1.1.1 or 1.2.1, as NVD advises.
Rebuild and redeploy container images so the patched binary actually ships.
Where patching must wait, consider rejecting Brotli-encoded request bodies at the gateway or in middleware. This is a general mitigation, not a vendor-published workaround.
Replace end-of-life Node.js lines (20.x and earlier), which do not receive the fix.

Related coverage

Sources

Spotted an error or outdated detail? Email contact@cyberstrikenews.com with the article link. We correct and note every change. Read our Editorial Policy.