Node2Shell: update runtimes that decode untrusted Brotli
A Node.js decoder flaw can allow code execution when an application decompresses attacker supplied Brotli data. Imperva demonstrated the impact in specific Linux arm64 configurations.
- Vendor
- Node.js
- Exposure
- Application or configuration dependent
- Vendor severity
- See original advisory
What happened
The defect is in Node.js, not Express itself. Request middleware and consumed HTTP responses can expose the decoder. A bare HTTP server does not decompress an incoming body merely because it receives it.
Imperva demonstrated code execution on Node.js 24.22.0 in Linux arm64 tests and rejection of the same input on 24.22.1. This is research evidence, not confirmation of attacks against customers.
Affected systems and fixes
| Product | Affected | Fixed release / action |
|---|---|---|
| Node.js 22.x | Before 22.23.4 | 22.23.4 |
| Node.js 24.x | Before 24.22.1 | 24.22.1 |
| Node.js 26.x | Before 26.12.1 | 26.12.1 |
Confirm the running version against the vendor advisory, including any distribution backports.
CISA exploitation evidence
Catalog 2026.10.23 · Checked Oct 24, 2026 UTC
No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.
Response checklist
Sources
Technical facts come from these sources. Priorities and suggested reviews are Oktsec’s analysis.
- October Node.js security releasesNode.js · vendor · Checked Oct 23, 2026 UTC
- Node2Shell research demonstrationImperva · research · Checked Oct 23, 2026 UTC
Editorial record1 entry
Added to the local collection after reviewing original sources. Disclosure date is shown separately from Radar coverage.
Choose what to review
Get incident alerts and briefings
Act now incidents and team briefings, with sources and recommended actions.
Checking availability…