Ethical Hacking News
Researchers have demonstrated a remotely exploitable bug in Node.js builds using crafted Brotli data, allowing malicious actors to inject code into otherwise secure applications. The vulnerability, which has been assigned the CVE-2026-111497 designation, affects applications on the 22.x, 24.x, and 26.x lines of Node.js. The patched release, 24.22.1, is now available, and developers are advised to update to mitigate the vulnerability.
Node.js has a remotely exploitable bug (CVE-2026-111497) in its Brotli decoder that allows malicious actors to inject code into secure applications. The vulnerability occurs due to the decoder's handling of an impossible point in a Brotli stream, leading to an out-of-bounds write and potential code execution. The affected applications include Express 5, which uses the Brotli decoder to decode request bodies, with specific versions (5.0.0-5.3.0, 2.0.0-2.3.0) being particularly vulnerable. A patched release (Node.js 24.22.1) has been released to fix the bug, and developers are advised to update to the patched release. Limiting untrusted Brotli traffic on affected paths may also prevent exploitation of the vulnerability, but this is not a workaround within Node.js.
In a recent demonstration of the vulnerability, Imperva researchers successfully demonstrated a remotely exploitable bug in Node.js builds using crafted Brotli data. The vulnerability, which has been assigned the CVE-2026-111497 designation, allows malicious actors to inject code into an otherwise secure application running on a Node.js build.
The vulnerability is found in the Brotli decoder, a component bundled with Node.js. According to the researchers, the decoder's handling of an impossible point in a Brotli stream allows it to continue decoding even when faced with an invalid stream. This can cause the decoder to enter an invalid state, leading to an out-of-bounds write and potentially allowing an attacker to execute arbitrary code.
The researchers' test, which used a specially crafted Brotli data file, demonstrated the vulnerability's effectiveness. They successfully ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding the crafted data to the bundled Brotli decoder. The test took several tries to succeed, and the researchers noted that the vulnerability was not exploitable in the wild as of October 22.
The implications of this vulnerability are significant, as it affects applications on the 22.x, 24.x, and 26.x lines of Node.js. The affected applications include Express 5, which uses the Brotli decoder to decode request bodies. According to the researchers, Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 are particularly vulnerable.
To mitigate the vulnerability, Node.js has released a patched release, 24.22.1, which fixes the bug by importing an upstream Brotli patch that makes the decoder stop with a format error at the point where the vulnerability occurs. Applications that use the Brotli decoder should update to the patched release.
In addition to the patched release, Imperva suggests limiting untrusted Brotli traffic on affected paths where possible, as this may prevent exploitation of the vulnerability. However, the company notes that only the update removes the vulnerability, and there is no workaround inside Node.js.
Other organizations, such as Vercel, have also taken steps to mitigate the vulnerability. Vercel added rules on October 21 that block the attack in inbound requests, although these rules do not cover Brotli responses fetched from other servers.
In conclusion, the vulnerability in Node.js's Brotli decoder is a significant security issue that affects a wide range of applications. The researchers' demonstration of the vulnerability's effectiveness highlights the need for applications to update to the patched release and for developers to take steps to mitigate the vulnerability.
Related Information:
https://www.ethicalhackingnews.com/articles/Malicious-Brotli-Data-Exploits-Nodejs-Build-Vulnerability-ehn.shtml
https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html
Published: Fri Oct 23 03:19:37 2026 by llama3.2 3B Q4_K_M
