Top Tweets for #node2shell
#Node2Shell: Critical Node.js Vulnerability Enables Remote Code Execution
Imperva researchers have demonstrated how a vulnerability in Node.js’s bundled Brotli decoder can allow attackers to execute arbitrary code through maliciously crafted compressed data.
Key findings:
• Remote Code Execution: CVE-2026-111497 can enable attackers to execute code within vulnerable Node.js application processes.
• Multiple Attack Paths: Exploitation was demonstrated through both compressed HTTP responses processed by Node.js fetch() and incoming Brotli request bodies handled by configured Express middleware.
• Confirmed Impact: Researchers successfully demonstrated code execution using the official Node.js 24.22.0 Linux ARM64 image. The patched version rejected the same malicious inputs.
• Immediate Mitigation: Upgrade affected Node.js deployments to fixed versions: 22.23.4, 24.22.1, or 26.12.1, or newer releases in the respective supported branches.
• Defense in Depth: Review container images, identify applications processing untrusted Brotli data, and consider WAF protections while deploying permanent fixes.
This vulnerability highlights why runtime security and rapid patching are just as important as securing application code. A flaw deep within a runtime can expose otherwise legitimate applications to remote code execution.
#Cybersecurity #NodeJS #ApplicationSecurity #RemoteCodeExecution #VulnerabilityManagement #DevSecOps #InfoSec
https://t.co/A7vNp0Wlay
🚨Node2Shell (CVE-2026-111497): Malicious Brotli input can trigger memory corruption and potential RCE in Node.js.
Patch to 22.23.4, 24.22.1 or 26.12.1 or newer supported versions. Rebuild containers. Verify production.
#NodeJS #Node2Shell #Cyvigilant
por isso que é melhor usar padrões e tecnologias consolidadas: se ainda usássemos só HTTP 0.9 sem request body não teria bug de upload; se ainda usássemos só deflate e gzip não teria bug no brotli
bugs geralmente acontecem quanto tentamos reinventar a roda #php2shell #node2shell
um velho truque apache 🪶 pra proteger o php 🐘 contra o CVE-2026-109618 e o CVE-2026-109619
Patched Node for Node2Shell (CVE-2026-111497)? Don't check process.versions.brotli.
Node fixed its bundled Brotli without bumping it: patched 24.22.1 still says 1.2.0, patched 22.23.4 says 1.1.0.
Trust node --version. npm audit won't catch it either.
#Node2Shell #NodeJS
🚨 #Python packages are vulnerable to RCE via the same #node2shell flaw, CVE-2026-111497.
You may be affected if you use the Brotli library, a very popular dependency (100M downloads/month).
Other major services are likely affected too. #Aikido detects this. Patches available.
I have some hobby projects in scala, node running in a framework with a php dashboard, I spent several evenings updating stuff. as patches come out
not to mention having to do it at work
And i'm afraid this is only the beginning
#php2shell #node2shell #eMudhra
‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js.
Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability.
Read full details ↓ https://t.co/Znn8SGEdBu
#HTTP2Shell や #Node2shell として話題になってる脆弱性について各方面から情報収集しました。
CVSS9.2で、緊急度も高めです。
既に修正バージョンでてるので、昨今の情勢も他踏まえて早めの対策が重要ですm(*_ _)m
https://t.co/fF3Cn4M4NA
#node2shell CVE-2026-111497 が朝起きたら #http2shell に化けていたでござる。
ざっと調べてたけど、週末に緊急対応するほどでもないかなと言う印象。
PythonやApacheなどに影響があるが、標準構成ではBrotliを扱わない設定になっていると思うので。
有識者の皆さん、どうでしょう？
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
#Node2shell CVE-2026-111497-POC
https://t.co/4rhjxpCoC0
Node2Shell: a crafted Brotli stream turns Node.js body-parser and fetch() into a path to RCE. https://t.co/eSQeF1iAru #ThreatIntel #CVE_2026_111497 #Node2Shell #ZLib
Apres la faille Php2shell, on a la faille node2shell
Ami(e) technicien et Administrateur système...
A vos marques, Pret ....Patchez 🏁💻
#PHP2Shell #NODE2Shell
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data https://t.co/01YOJzsgmj
#Nodejs #brotlidata #RCE #Node2shell #cybersecurity #cyberattack
To all "awesome and cool developers", looking down at #PHP and calling it a shit platform in various forms, I'll be available this afternoon for a sit down where we talk about #Node2Shell 🧐
#php2shell #cybersec #cybersecurity #exploit #rce #CVEALERT #nodejs #Node
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers