From The Hacker News
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw
Publisher-provided RSS excerpt. This is not the full article or an independently verified AEGLIX assessment.
Read the full story at The Hacker News ↗ (opens in a new tab)