The Hacker News (Security) Oct 23, 2026 · 8:40 AM · 1 min read

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

This is a summary aggregated from The Hacker News (Security). Read the complete article on the original site:

Read full article at The Hacker News (Security)

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

More Cybersecurity News

Ranking the Estate: Where BeyondTrust Appliances Cluster and Why It Changes Triage

Critical PHP Fixes Put Crypto Checkout Infrastructure In Focus

Japan to set up AI hacker team as PHP flaws knock services offline

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

State Bank of India Suffers a Customer PII Data Leak

Amex Says App and Website Disruptions ‘Not Caused by a Security Vulnerability’