Imperva Researchers Reveal Remote Code Execution via Crafted Brotli Data on Official Node.js Build

Security researchers at Imperva have demonstrated a remote code execution (RCE) vulnerability that can be triggered by a specially crafted Brotli-compressed payload on the official Node.js 24.22.0 image for Linux arm64, a proof‑of‑concept they have dubbed "Node2Shell."

The exploit works without the need for a debugger or additional tooling. By feeding malicious Brotli data into a vulnerable Node.js process, the researchers showed that attacker‑supplied code can be executed directly within the runtime, effectively giving the adversary a shell on the host system.

Node.js, the widely used JavaScript runtime that powers countless web services and server‑side applications, incorporates Brotli decompression libraries to handle compressed HTTP traffic. Brotli has become the default compression method for many modern browsers and CDNs because of its high compression ratios and speed, making it a common vector for data entering Node.js applications.

In the Imperva demonstration, the vulnerability manifested on the official Node.js 24.22.0 Docker image for the arm64 architecture, a platform increasingly adopted for cloud and edge deployments. The researchers did not need to modify the runtime or inject external modules; the crafted Brotli stream alone was sufficient to corrupt memory and hijack execution flow.

The practical implications are significant. Any service that accepts Brotli‑compressed input—such as API endpoints, microservices, or serverless functions—could be exposed to arbitrary code execution if it runs the affected Node.js version. Attackers could potentially gain footholds in production environments, exfiltrate data, or pivot to other systems within a network.

Following the disclosure, maintainers of Node.js have been alerted and are expected to issue a security update that mitigates the flaw, likely by tightening validation of decompression buffers or by patching the underlying libbrotli handling code. In the interim, security teams are advised to upgrade to patched releases as soon as they become available, consider disabling Brotli support where it is not essential, and enforce strict input validation.

The Node2Shell finding adds to a growing list of supply‑chain‑related vulnerabilities that affect core development platforms. Similar issues have surfaced in other runtimes and libraries, underscoring the importance of rigorous testing of third‑party code and the need for rapid patch deployment in production environments.

Organizations running Node.js workloads are encouraged to monitor official advisories, apply security patches promptly, and review their compression handling logic. Imperva’s proof of concept serves as a reminder that even well‑maintained, officially distributed software can harbor critical flaws, and continuous vigilance remains essential for safeguarding modern web infrastructure.