Zararli Brotli ma'lumotlari Node.js rasmiy build'ida ishlaydigan ilovani hujumchi taqdim etgan kodni bajarishga majbur qilishi mumkin, deb Imperva xavfsizlik tadqiqotchilari namoyish etishdi.
Ularning "Node2Shell" proof of concept'i Linux arm64 uchun rasmiy Node.js 24.22.0 tasvirida, hech qanday debugger yoki maxsus build'siz, o'rnatilgan Brotli dekoderiga (CVE-2026-111497) maxsus ma'lumotlar yuborish orqali kodni bajardi. Node.js 21-oktabrda kamchilikni e'lon qildi va tuzatishlarni chiqardi; ishonchsiz Brotli ma'lumotlarini dekodlaydigan ilovalar yangilanishi kerak.
Imperva sinovi har bir urinishda muvaffaqiyatli bo'lmadi va Linux arm64 sozlamasida kod bajarilishi bir necha urinishni talab qildi. Natija faqat shu bitta build va ilova sozlamasini qamrab oladi; boshqa arxitekturalar va 22.x hamda 26.x liniyalari sinovdan o'tkazilmagan. Tuzatilgan 24.22.1 versiyasida xuddi shu ma'lumotlar rad etildi va hech qanday kod bajarilmadi.
Namoyish avvalgi ommaviy proof of concept'dan yuqoriroq: u faqat ataylab zaiflashtirilgan test build'da kod bajarilishini ta'minlagan edi. Standart build'da o'sha proof of concept muallifi crash va jarayon xotirasining cheklangan o'qilishini, kod bajarilishini emas, xabar qildi va normal build'da ishlaydigan hujum amalga oshirilmaganini aytdi.
22-oktabr holatiga ko'ra, bu kamchilikning yovvoyi tabiatda ekspluatatsiya qilingani haqida xabar berilmagan.
Qaysi Ilovalar Ta'sirlangan
Kamchilik Node.js o'rnatgan Brotli dekoderida, shuning uchun u faqat Imperva sinovdan o'tkazgan bitta build emas, balki 22.x, 24.x va 26.x liniyalaridagi ilovalarga ta'sir qiladi. Xizmat bu dekoderga HTTP almashinuvi har ikki tomondan yetib boradi: u Node.js'ning o'rnatilgan fetch() orqali Brotli-siqlangan javobni o'qiganda, yoki middleware Brotli-siqlangan so'rov tanasini dekodlaganda.
Express 5'ning body parser'lari, masalan express.json(), express.urlencoded(), express.text() va express.raw(), endi gzip va deflate bilan birga Brotli so'rov tanalarini ham dekodlaydi, agar ular marshrutga qo'llanilsa. Oddiy Node.js HTTP serveri Brotli so'rov tanasini faqat qabul qilish bilan dekodlamaydi, shuning uchun dekodlash o'sha middleware yoki aniq chaqiruvni talab qiladi.
Imperva so'rov tanasi va javob yo'llari orqali kod bajarilishini takrorladi, Express 5.0.0 dan 5.3.0 gacha va body-parser 2.0.0 dan 2.3.0 gacha pinlangan versiyalarni sinovdan o'tkazdi va oraliqdagi har bir relizni sinovdan o'tkazmadi.
Xato Qanday Ishlaydi
Imperva sababni dekoder Brotli oqimidagi mumkin bo'lmagan nuqtani qanday ishlashiga bog'ladi: oqim dekodlash davomida ishlatiladigan blok turlarini e'lon qiladi va test kiritmasi oqimning o'z tuzilishi rad etgan blok o'zgarishiga yetib bordi. Zaif dekoder buni ko'proq kiritma so'rovi sifatida o'qidi va noto'g'ri holatda davom etdi.
Xotira sanitizer bilan alohida sinovda, o'sha holatdan davom etish mo'ljallangan buferdan tashqariga yozdi — bu kamchilik ortidagi chegaradan tashqari yozish.
Node.js kamchilikni yuqori darajadagi Brotli patch'ini import qilish orqali tuzatdi, bu dekoderga o'sha nuqtada format xatosi bilan to'xtashni, davom etmaslikni buyuradi.
Nima Qilish Kerak
Tuzatish — patch'langan relizga o'tish. Yangilanish Node binarini o'z ichiga olgan konteyner tasvirlari va boshqa artefaktlarga ham yetib borishi kerak, chunki paket inventarizatsiyasi buni o'tkazib yuborishi mumkin. Hayot tugagan 20.x va undan oldingi liniyalar tuzatish olmaydi va qo'llab-quvvatlanadigan liniyaga ko'chirilishi kerak.
Maslahatda Node.js ichida hech qanday workaround ro'yxatga olinmagan, shuning uchun bir zumda yangilana olmaydigan ilova runtime'da hech qanday zaxira variantiga ega emas. Imperva amaliy bo'lgan joylarda ta'sirlangan yo'llarda ishonchsiz Brotli trafikini cheklashni taklif qildi va faqat yangilanish kamchilikni butunlay bartaraf etishini aytdi. Kompaniya o'z veb-ilova firewall'iga qoidalar qo'shdi va ularni takrorlagan hujumlarga qarshi sinovdan o'tkazdi.
Mijozlari uchun Node.js'ni ishlatadigan Vercel 21-oktabrda kiruvchi so'rovlarda hujumni bloklaydigan qoidalar qo'shganini aytdi. Bu qoidalar ilova boshqa serverlardan oladigan Brotli javoblarini qamrab olmaydi va yangilanishni almashtirmaydi.
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.
Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw and released fixes on October 21, and applications that decode untrusted Brotli data should update.
Imperva's test did not succeed on every attempt, and code execution took several tries in its Linux arm64 setup. The result covers that one build and application setup, with other architectures and the 22.x and 26.x lines not tested. On the fixed release, 24.22.1, the same data was rejected, and no code ran.
The demonstration goes beyond the first public proof of concept, which achieved code execution only on a deliberately weakened test build. On a standard build, that proof of concept's author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved.
No exploitation of the flaw in the wild has been reported as of October 22.
Which Applications Are Affected
The flaw is in the Brotli decoder that Node.js bundles, so it affects applications on the 22.x, 24.x, and 26.x lines, not only the one build Imperva tested. A service reaches that decoder from either side of an HTTP exchange: when it reads a Brotli-compressed response through Node.js's built-in fetch(), or when middleware decodes a Brotli-compressed request body.
Express 5's body parsers, such as express.json(), express.urlencoded(), express.text() and express.raw(), now decode Brotli request bodies when applied to a route, alongside gzip and deflate. A plain Node.js HTTP server does not decode a Brotli request body just by receiving one, so the decoding needs that middleware or an explicit call.
Imperva reproduced code execution through both the request-body and response paths, testing Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 at pinned versions, and did not test every release in between.
How the Bug Works
Imperva traced the cause to how the decoder handles an impossible point in a Brotli stream: the stream announces the block types it will use as decoding runs, and the test input reached a block change that the stream's own structure ruled out. The vulnerable decoder read that as a request for more input and kept going in an invalid state.
In a separate test with a memory sanitizer, continuing from that state wrote past an intended buffer, the out-of-bounds write behind the flaw.
Node.js fixed the flaw by importing an upstream Brotli patch that makes the decoder stop with a format error at that point instead of continuing.
What to Do
The fix is to move to a patched release. The update should reach container images and other artifacts that bundle a Node binary, which a package inventory can miss. End-of-life lines 20.x and earlier do not receive the fix and should be moved to a supported line.
The advisory lists no workaround inside Node.js, so an application that cannot update at once has no fallback in the runtime. Imperva suggested limiting untrusted Brotli traffic on affected paths where that is practical, and said only the update removes the flaw. The company also added rules to its own web application firewall and tested them against the attacks it reproduced.
Vercel, which runs Node.js for its customers, said it added rules on October 21 that block the attack in inbound requests. The rules do not cover Brotli responses an application fetches from other servers, and do not replace updating.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.