Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Security researchers at Imperva demonstrate a Node2Shell RCE exploit using crafted Brotli data on an official Node.js 24.22.0 image for Linux arm64.
Intelligence analysis by Qwen 2.5 (3B)
Security researchers at Imperva reveal a vulnerability in Node.js's Brotli decoder, allowing an RCE exploit on a standard build.
Security researchers found a bug in Node.js that lets attackers trick the software into running their own code. It's like tricking a computer into thinking it's getting more data than it actually is, which lets the attacker do bad things.
Analysis
{"heading_1":"The Vulnerability","content_1":"Imperva researchers demonstrate a Node2Shell RCE exploit using crafted Brotli data on an official Node.js 24.22.0 image for Linux arm64. The vulnerability is in the Brotli decoder that Node.js bundles.","heading_2":"Imperva's Test","content_2":"Imperva's test did not succeed on every attempt, and code execution took several tries in their Linux arm64 setup. The demonstration goes beyond the first public proof of concept, which achieved code execution only on a deliberately weakened test build.","heading_3":"How the Bug Works","content_3":"The vulnerability is caused by how the decoder handles an impossible point in a Brotli stream. The decoder read that as a request for more input and kept going in an invalid state. In a separate test with a memory sanitizer, continuing from that state wrote past an intended buffer, the out-of-bounds write behind the flaw."}
Key points
- Security researchers at Imperva demonstrate a Node2Shell RCE exploit using crafted Brotli data on an official Node.js 24.22.0 image for Linux arm64.
- The vulnerability is in the Brotli decoder that Node.js bundles.
- The fix is to move to a patched release of Node.js.
The fix is to move to a patched release of Node.js. The update should reach container images and other artifacts that bundle a Node binary, which a package inventory can miss.
No workaround inside Node.js removes the flaw. Applications that cannot update at once have no fallback in the runtime.
