What Is Node2Shell? The Critical Node.js Vulnerability Explained for Security Leaders

Node2Shell is the name for CVE-2026-111497, a buffer overflow in the Brotli decoder bundled with Node.js. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt memory, leak sensitive data, crash the service, or potentially run code. On October 22, 2026, Imperva demonstrated code execution on the official Node.js 24.22.0 image. 

Node.js is running in places your inventory cannot see 

Node.js powers internal web apps, APIs, customer and vendor portals, serverless functions, and build tooling. It is also embedded in container images and vendor-supplied products, where package inventories often miss it. Patching the servers you know about does not close the exposure inside the products you buy. 

What’s inside the report

• How Node2Shell works and the two attack paths Imperva reproduced
• Which Node.js and Brotli versions are affected
• Patched versions, and what needs to be rebuilt
• Why WAF and edge rules leave a gap
• What to ask vendors whose products embed Node.js