Imperva's researchers ran attacker-supplied code on an official Node.js 24.22.0 image for Linux arm64, with no debugger and no custom build, by feeding crafted data to the Brotli decoder that Node bundles. The proof of concept, which they call Node2Shell, targets CVE-2026-111497. Node.js disclosed the flaw and shipped fixes on October 21.

The result comes with limits worth stating up front. The exploit did not land on every attempt; code execution took several tries in that arm64 setup. Imperva tested one build and one application configuration, and did not test other architectures or the 22.x and 26.x release lines. On the fixed build, 24.22.1, the same input was rejected and nothing ran.

That still clears a bar the earlier public work did not. The first public proof of concept achieved code execution only on a deliberately weakened test build. On a standard build, its author reported a crash and a limited read of process memory, and said no working attack on a normal build was achieved.…