Researchers Demonstrate Node2Shell RCE Exploit on Nodejs Build Using Crafted Brotli Data

Malicious Brotli data can make an application on an official build of Nodejs run attackersupplied code security researchers at Imperva have demonstrated Their Node2Shell proof of concept ran code on the official Nodejs 24220 image for Linux arm64 with no debugger or custom build by feeding crafted data to the bundled Brotli decoder CVE2026111497 Nodejs disclosed the flaw