Imperva researchers demonstrated remote code execution in Node.js via CVE-2026-111497, triggered by malformed Brotli streams in decoder handling.
Affects Node.js 22.x, 24.x, and 26.x.
Patches were released on October 21, 2026.
The Imperva research team managed to run code on an official version of Node.js for specific systems, without any special modifications, by leveraging the way the system handles compressed data.
How apps are affected
The issue affects the 22.x, 24.x, and 26.x release series. The vulnerability is triggered when an application reads compressed data from the internet or when the tools that handle incoming requests take on the task of decoding it.
The researchers' tests showed that the attack could succeed in well-known libraries, such as Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0. The flaw stems from the fact that, when the system encounters an invalid data stream, it does not stop but continues to function incorrectly, writing data beyond the allowed memory limits.
READ ALSO
Critical security flaw in Arista's VeloCloud Orchestrator exploited in attacks
The official reaction and corrections
On October 21, Node.js announced a fix for the issue and released new versions, such as 24.22.1. In the new version, dangerous data is discarded and no code is executed. As of October 22, no actual attacks on user systems had been reported.
As a precaution, administrators should immediately upgrade to a patched version. Older series that are no longer supported will not receive updates, and applications that use them should be migrated to newer, supported versions. In addition, companies such as Vercel have added rules to block suspicious requests, but this measure is not a substitute for the necessary software update.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)