News
cybersecurity Hackers Target Critical PHP2Shell Vulnerabilities With Exploits to Deploy Mirai Botnet Malware - CyberPress threat-intel Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware - GBHackers cybersecurity SBI Confirms Customer Data Affected by Cyber Incident, Says Account Funds Are Safe - CyberPress cybersecurity Atlassian Patches 75 Flaws in Data Center and Server Products - SecurityWeek cybersecurity Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data - The Hacker News cybersecurity PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware - The Hacker News cybersecurity New BlackX UEFI Bootkit Bypasses Windows Secure Boot Even After Security Updates - CyberPress threat-intel North Korea Hit by Multiple Waves of DDoS Attacks, Knocking Over 40 Websites Offline - GBHackers cybersecurity North Korea Hit by Multiple Waves of DDoS Attacks, Knocking Websites Offline - CyberPress cybersecurity Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 - SecurityWeek cybersecurity Oracle Patches Critical Java Security Flaw That Could Allow Hackers to Steal Data - CyberPress threat-intel Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks - GBHackers cybersecurity Hackers Use Critical NetScaler RCE Flaw to Target Appliances With Web Shells and Malware - CyberPress cybersecurity Low-Skilled Hacker Used AI Agents to Hack University and Steal Thousands of Records - CyberPress threat-intel PwC Allegedly Hit by Everest Ransomware Group, 590GB of Data Stolen - GBHackers
1 / 15
All news ›
Cybersecurity

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

The Hacker News ·

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

Continue on The Hacker News ↗ ‹ All news Get the newsletter

The summary and image come from The Hacker News; the image is shown from their website.