Node2Shell RCE demonstrated on an official Node.js 24 build

Imperva researchers have demonstrated that Node2Shell (CVE-2026-111497) can execute code on an official, unmodified Node.js 24.22.0 image running Linux arm64. The exploit uses crafted Brotli data and took several attempts; Node.js 24.22.1 rejects the same input. Applications that decode attacker-controlled Brotli data should update to a fixed release. Source

Read the full article at the source.