negativeSYS.SOURCE: The Hacker News• 2026-10-23T14:10:43+05:30

Node2Shell RCE Exploit Demonstrated via Crafted Brotli Data in Node.js 24.22.0

#vulnerability #nodejs #rce #security

Security researchers demonstrated a remote code execution (RCE) exploit in Node.js 24.22.0 using crafted Brotli data, leveraging CVE-2026-111497. The vulnerability allows execution of attacker-supplied code through the bundled Brotli decoder without requiring custom builds or debuggers.

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.

Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

Read original article

*** END OF TRANSMISSION ***

> QUEST DIAGNOSTICS CONFIRMS CYBERATTACK LEADING TO PATIENT DATA BREACH > EMUDHRA'S PRIVATE KEY COMPROMISE OF INTERMEDIATE CERTIFICATES AND MOZILLA ROOT INVESTIGATION DEADLINE OMISSION > LARGE-SCALE CYBERATTACK EXPLOITS ENTERPRISE FIREWALLS AND VPNS, LEAKING 70,000 CREDENTIALS > INVESTOR-OWNED UTILITIES CHARGE 23% MORE FOR ELECTRICITY THAN PUBLIC PROVIDERS > SHITTER: A PRIVACY-FOCUSED NITTER FORK FOR ALTERNATIVE TWITTER ACCESS > OPENSSL 4.1.0 RELEASE: ENHANCED CRYPTOGRAPHIC FEATURES AND PLATFORM SUPPORT > AI-GENERATED WIKI OF ENRON EMAILS WITH SOURCE CITATIONS > SWEDISH GOVERNMENT OFFICES PROHIBIT USE OF CHATGPT AND CLAUDE AI MODELS > PHP IDENTIFIES UNPATCHED RCE VULNERABILITY CVE-2026-115560 AMID RECENT SECURITY UPDATES > RUSSIAN STATE-SPONSORED HACKERS EXPLOIT MESH NETWORK BACKDOOR IN UKRAINE CYBERATTACK> QUEST DIAGNOSTICS CONFIRMS CYBERATTACK LEADING TO PATIENT DATA BREACH > EMUDHRA'S PRIVATE KEY COMPROMISE OF INTERMEDIATE CERTIFICATES AND MOZILLA ROOT INVESTIGATION DEADLINE OMISSION > LARGE-SCALE CYBERATTACK EXPLOITS ENTERPRISE FIREWALLS AND VPNS, LEAKING 70,000 CREDENTIALS > INVESTOR-OWNED UTILITIES CHARGE 23% MORE FOR ELECTRICITY THAN PUBLIC PROVIDERS > SHITTER: A PRIVACY-FOCUSED NITTER FORK FOR ALTERNATIVE TWITTER ACCESS > OPENSSL 4.1.0 RELEASE: ENHANCED CRYPTOGRAPHIC FEATURES AND PLATFORM SUPPORT > AI-GENERATED WIKI OF ENRON EMAILS WITH SOURCE CITATIONS > SWEDISH GOVERNMENT OFFICES PROHIBIT USE OF CHATGPT AND CLAUDE AI MODELS > PHP IDENTIFIES UNPATCHED RCE VULNERABILITY CVE-2026-115560 AMID RECENT SECURITY UPDATES > RUSSIAN STATE-SPONSORED HACKERS EXPLOIT MESH NETWORK BACKDOOR IN UKRAINE CYBERATTACK