Node2Shell: From Brotli Data to Remote Code Execution

Imperva Red Team demonstrated remote code execution against the official vulnerable Node.js build, then confirmed that the fixed release rejects the same Brotli input. Executive summary Node2Shell is Imperva Red Team's name for our analysis of CVE-2026-111497, a High severity flaw in Node.js's...