Imperva researchers reported on October 22, 2026 that Node2Shell, their analysis of a Node.js Brotli decoder vulnerability, demonstrated remote code execution in applications running an official Node.js build. Tracked as CVE-2026-111497, the flaw affects the 22.x, 24.x and 26.x release lines, according to the Node.js project. Exposure depends on an application decompressing attacker-controlled Brotli data.

The Node.js project released fixes on October 21 and rates the vulnerability high severity. Its advisory identifies an out-of-bounds write in the bundled decoder that can permit remote code execution. Imperva's subsequent research adds a tested attack scenario to that disclosure; the reported results concern laboratory exploitation rather than a confirmed attack campaign.

Imperva said its proof of concept executed supplied code in fresh Linux arm64 containers using the official Node.js 24.22.0 image, without a debugger or instrumented binary. Execution required multiple attempts. The same inputs were rejected by version 24.22.1. The researchers cautioned that their findings establish exploitation for the tested build and application configurations, not every Node.js deployment.

The team tested both compressed responses consumed through the built-in fetch() function and incoming request bodies decoded by configured Express and body-parser middleware. Imperva traced the problem to the decoder continuing after an invalid stream condition. Vercel likewise warns that either request bodies or fetched responses can expose an application when they contain attacker-controlled Brotli data.

The fixed Node.js releases are 22.23.4, 24.22.1 and 26.12.1. Vercel advises upgrading externally managed runtimes, including self-hosted Next.js, container images, CI runners and development environments. It says Node.js 20 will not receive this fix and directs affected Vercel projects to switch to Node.js 22 or 24 and redeploy. Code execution would run with the permissions of the Node.js process.

Vercel says its web application firewall blocks known inbound exploit patterns, but cannot protect against malicious responses fetched from other servers and does not replace patching. Imperva recommends checking the runtime inside each deployed host or image and reviewing paths that decode untrusted Brotli data. Its guidance also cautions that decoder errors and unexpected process exits alone do not establish exploitation.