CYBER● ELEVATED1h ago · Oct 23, 2026, 7:50 AM
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
The Hacker News · global
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw
GlobeAlert aggregates and classifies open sources; the story above belongs to its publisher. Summaries are machine-generated from the source text.
More in Cyber
CYBERnow[Virtual Event] Cybersecurity Outlook 2027Dark ReadingCYBERnow[Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AIDark ReadingCYBER58m agoWhat is PHP and why has it triggered a global wave of cybersecurity measures?BBC AfriqueCYBER2h agoPHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai MalwareThe Hacker News