Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Imperva demonstrated code execution via crafted Brotli data on an official Node.js 24.22.0 Linux arm64 image; Node.js has issued fixes.
More info