EP. 188: Node2Shell Turns Compressed Data Into Remote Code Execution

The Digital Warfare Podcast · Oct 23, 2026 · 4m · transcript

Summary

CVE-2026-111497, also referred to as Node2Shell, is an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js. Specially crafted Brotli data can corrupt adjacent memory and potentially lead to remote code execution without authentication or user interaction.

Imperva demonstrated code execution against the official vulnerable Node.js 24.22.0 Linux ARM64 image, including application paths involving built-in fetch(), Express, and body-parser. The same malicious inputs were rejected by patched Node.js 24.22.1.

Key Takeaways

• CVE-2026-111497 affects Node.js Brotli…