Latest / The Digital Warfare Podcast / EP. 188: Node2Shell Turns Compressed Data Into Remote Code Execution
Transcript
- riverside 6adb5f6aa18389c8376f2136 0 final padding digital warfare's s: A compressed web request should save bandwidth. It should not give somebody control of your server. But that is exactly the danger behind CVE-2026-111497. Welcome to the Digital Warfare Daily Brief. Today's threat is being called Node to Shell. It targets the Brotley decompression code bundled inside Node.js and, under the right conditions, specially crafted compressed data. Can push the decoder beyond its intended memory boundary. The result? Memory corruption, sensitive memory exposure, application crashes, and potentially remote code execution. Here is what makes this serious. The attacker does not necessarily need an account. They do not need a password. They do not need a user to click anything. They need a vulnerable application that processes attacker-controlled Brotly data. That could arrive through an incoming compressed request body, or it could arrive through a brottly compressed response that a node.js application retrieves from another service. Either route can reach the same vulnerable native decoder, and researchers have now proven the impact. Imperva demonstrated code execution against the official Node.js 24.22.0 Linux ARM64 image. Their proof of concept delivered crafted Brotly input into the target process. Code executed. A marker file appeared. Then they ran the same input against the patched node.js 24.22.1 release. The exploit path stopped. That is the difference one security update can make. Imperva. Technically, the flaw is an out-of-bounds right. A malformed Brotly stream can push the vulnerable decoder into an invalid internal state. Instead of terminating cleanly when that state is reached, processing can continue. Memory outside the intended buffer can then be overwritten. And once an attacker can influence memory inside a native process, the consequences can escalate rapidly. Now understand the exposure. Node.js powers APIs, web applications, microservices, back-end systems, cloud workloads, containers, development platforms. And middleware such as Express and Body Parser can automatically decompress Brotly request bodies when configured to do so. Imperva reproduced code execution through those paths as well. The floor is in Node.js itself, not Express. But Express can become the route that delivers hostile compressed data into the vulnerable decoder. ImpervaTheNode.js project says 22.x, 24.x, and 26.x are affected. The fixed releases are 22.23.4, 24.22.1, and 26.12.1. Node.js. Now, the important distinction. Researchers have demonstrated successful exploitation. That does not mean widespread active attacks have been confirmed in the wild. Do not exaggerate the threat. But do not underestimate it either. A working proof of concept dramatically shortens the distance between vulnerability disclosure and attacker weaponization. So, here are today's defensive orders. Find the runtimes. Check production servers. Check containers. Check Kubernetes workloads. Check build images. Check anything carrying its own node binary. Do not assume your package inventory sees every vulnerable runtime. Then patch. Move every supported deployment onto 22.23.4, 24.22.1, 26.12.1, or a newer fixed release. Then map where untrusted Brotly data enters your applications. Review request decompression. Review external responses consumed through Node's built-in fetch functionality. Look for unexpected process crashes, decoder errors, or abnormal behavior around compressed traffic. And if you cannot patch immediately, reduce exposure to untrusted Brotly input while the update rolls out. Because this vulnerability delivers a simple warning. The dangerous code is not always in the application you wrote. Sometimes it is buried underneath it, inside the runtime, inside the decoder, waiting for one malicious stream to reach the wrong memory address. Patch node.js. Map the brotly paths. And do not give compressed attacker data a straight line into vulnerable native code. This has been the Digital Warfare Daily Brief. Stay secure and stay ahead.