October 24, 2026
- Imperva demonstrated Node2Shell code execution on an official Node.js build, running attacker code on the stock 24.22.0 Linux arm64 image with no debugger or custom build by feeding crafted Brotli data to the bundled decoder (CVE-2026-111497). It took several attempts and covers that one build and app setup; 22.x and 26.x and other architectures were not tested, and 24.22.1 rejects the input. Reachable via
fetch()on Brotli responses or Express 5 body parsers; no in-the-wild exploitation reported as of October 22 (The Hacker News). The same decoder bug reaches curl and Git (GitHub advisory), and Python packages are also affected (NCSC-NL) — a step up from Thursday's weakened-build PoC. (discussion) · Vulnerabilities & Exploits
in PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug