Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer
vulnerability Imported story

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Source: The Hacker News · Published · Last checked 1 week ago · 1 min read
Illustration generated by CyberSecurity.pk from the story topic.
Read original source ↗ (thehackernews.com)

Publisher excerpt From The Hacker News

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.

Related CVEs

CVE-2026-111497 · CRITICAL
Keywords: rceCVE-2026-111497vulnerabilityvulnerability newsThe Hacker Newscybersecurity newssecurity news Pakistan

Reference: The Hacker News — thehackernews.com ↗

Related news

Chromium CVE-2026-76025: Use after freeChromium CVE-2026-76026: Memory corruptionChromium CVE-2026-76027: Memory corruptionChromium CVE-2026-76028: Use after free