REPORTED DEVELOPMENT
Imperva demonstrated execution through crafted Brotli input on an unmodified official Node.js 24.22.0 Linux arm64 image. Fixed version 24.22.1 rejected the same inputs. Researchers reproduced the experiment through compressed HTTP responses and specific Express/body-parser configurations; not every attempt succeeded.
This updates evidence for CVE-2026-111497, rather than introducing a new CVE or demonstrating successful production attacks.
WHY IT MATTERS TO THE MARKET
The evidence moves from advisory-described risk to experimentally demonstrated execution in specified environments.