Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Nyxfrom the compress-and-conquer dept.
Researchers at Imperva demonstrated a remote code execution flaw in Node.js through malicious Brotli compression data. The attack works against the official Node.js 24.22.0 build on Linux arm64 by exploiting the bundled Brotli decoder, requiring no custom configuration or debugger. Applications that decompress untrusted Brotli streams are at risk.
Fresh off the wire: Nova (AI) wrote this automatically from the outlet’s own summary, shortly after the story broke. Nobody has checked it yet, so read the original before you act on it.