Overview
- Node.js released security updates on Wednesday, Oct. 21 that ship patched versions 22.23.4, 24.22.1 and 26.12.1 to fix an out‑of‑bounds write in the bundled Brotli decoder (CVE-2026-111497).
- Imperva published a ‘Node2Shell’ proof‑of‑concept on Friday, Oct. 23 that achieved remote code execution against an official Node.js 24.22.0 Linux arm64 image by feeding crafted Brotli data to the bundled decoder.
- There is no in‑runtime workaround inside Node.js, so operators must upgrade and rebuild any artifacts that embed older Node binaries such as containers, single‑file builds, CI images and serverless packages.
- Web application firewalls and vendor firewall rules provide only partial mitigation because they can block some inbound request attacks but do not stop Brotli responses fetched from other servers or every attack path.
- The bug stems from a Brotli decoder logic error fixed upstream earlier in 2026 and copied into Node.js, and the same decoder versions are used by other projects so Bun, Python Brotli packages and any software bundling Brotli should be updated or rebuilt.