Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

The Hacker News · Friday, 23 October 2026 at 08:40 (1h ago) · Original article ↗

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.

Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

You're reading a preview. The full article is published by The Hacker News on their website.

Read the full story on The Hacker News

Security

A public outing of severe and unfixed Linux kernel vulnerabilities should have you thinking of updating your SteamOS or other distros to beta branches

The accidental reveal of unpatched vulnerabilities as high as 9 on the CVSS score chart is a little worrisome.

PC Gamer 38m ago

Security

Google makes a privacy policy exception to use your Gmail and Photos data for ads

Your inbox has secrets, and Google's ads might want in.

Android Authority 1h ago

Security

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks…

The Hacker News 2h ago

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

More Security & Privacy

A public outing of severe and unfixed Linux kernel vulnerabilities should have you thinking of updating your SteamOS or other distros to beta branches

Google makes a privacy policy exception to use your Gmail and Photos data for ads

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware