\n| Node.js<\/td>\n | Below 26.12.1<\/td>\n | 26.12.1 or Later<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u203b Versions that have reached end of life (Node.js 20.x and earlier, as well as 23.x, 25.x, etc.) do not receive security updates. We recommend upgrading to a supported version.<\/p>\n<\/div>\n<\/li>\n<\/ul>\n \u25a0 Impact and Attack Conditions<\/strong><\/span><\/h2>\nThis vulnerability occurs when the Brotli library bundled with Node.js writes data beyond the allowed range of its internal buffer while decompressing malformed compressed data.<\/p>\n If an attacker delivers crafted Brotli-compressed data to an application, and the application processes it using the vulnerable decompression function, process memory corruption may result in denial of service, remote code execution, and other damage.<\/p>\n Actual exploitability therefore depends on whether the application or the libraries it uses have a path through which externally supplied Brotli-compressed data is decompressed. The following processing paths should be reviewed:<\/p>\n \n- Handling Brotli-compressed HTTP request data<\/li>\n
- Automatically decompressing compressed responses received from external servers<\/li>\n
- Decompressing uploaded files or external data using Brotli<\/li>\n<\/ul>\n
Related functions include brotliDecompress(), brotliDecompressSync(), and createBrotliDecompress() in the node:zlib module.
\nEven if the application does not call these functions directly, middleware or HTTP client libraries may use them internally, so these should be checked as well.<\/p>\n \u25a0 How to Check for the Vulnerability<\/strong><\/span><\/h2>\n\n \n As this vulnerability resides in the native Brotli library bundled with Node.js, you need to verify the Node.js version actually used by your service and whether the security patch has been applied.<\/p>\n<\/div>\n<\/div>\n \u2460 Check the Node.js Version<\/strong><\/span><\/h3>\nOpen a command prompt or terminal on Windows or Linux and run the following command.<\/p>\n –\u00a0 Command<\/strong><\/p>\nnode -v<\/code><\/pre>\n–\u00a0 Example Output<\/strong><\/p>\nv22.23.3<\/code><\/pre>\nThis output indicates that Node.js 22.23.3 is installed. Since this is earlier than the fixed version 22.23.4, a security update is required.<\/p>\n \u2461 Check the location of the Node.js executable<\/strong><\/span><\/h3>\n–\u00a0 Windows<\/strong><\/p>\nwhere.exe node<\/code><\/pre>\n–\u00a0 Linux<\/strong><\/p>\ncommand -v node<\/code><\/pre>\nThe path of the Node.js executable used in the current shell can also be checked with the following command.<\/p>\n node -p \"process.execPath\"<\/code><\/pre>\nNote that the commands above only identify the Node.js used in the current shell. Your actual service may be using a Node.js instance from a separate installation path, a version manager, a service account, or inside a container.<\/p>\n Therefore, the service\u2019s execution configuration and the version inside the container must be verified separately. If necessary, process.version<\/code>\u00a0and process.execPath<\/code> can be checked from within the actual application process via internal diagnostic logs.<\/p>\n\u2462 Check Brotli Decompression Paths<\/strong><\/span><\/h3>\nVerify whether the application and the libraries it uses make use of Brotli decompression, and whether external input can reach that functionality. Version checks determine whether a patch is needed, while decompression path review determines whether the service is actually exposed.<\/p>\n \u25a0 Remediations<\/strong><\/span><\/h2>\n\u2714\ufe0f Operating environment review<\/strong><\/span><\/p>\n\n- Check whether Node.js is installed, which version is in use, and whether it is a vulnerable version<\/li>\n
- Check whether the application and its libraries use Brotli decompression<\/li>\n<\/ul>\n
\u2714\ufe0f Apply security patches (*see the table above)<\/strong><\/span><\/p>\n\n- For Node.js 22.x, 24.x, and 26.x, apply the security update corresponding to each version<\/li>\n
- For end-of-life Node.js versions, upgrade to a supported version that includes the security patch<\/li>\n
- After updating, restart the service and verify that the patched version is applied in the actual runtime environment<\/li>\n
- In container environments, rebuild or replace the image with one that includes the fixed Node.js, then redeploy<\/li>\n<\/ul>\n
\u2714\ufe0f If immediate updating is not possible<\/strong><\/span><\/p>\nIf the security patch cannot be applied immediately, we recommend the following temporary measures to prevent attacker-supplied Brotli data from reaching the vulnerable decompression function.<\/p>\n \u2013 If Brotli-compressed requests are handled:<\/strong> Block Brotli-compressed requests before the decompression stage, or temporarily disable the related functionality
\n\u2013 If external HTTP responses are decompressed:<\/strong> Consider disabling automatic Brotli decompression in the client library
\n\u2013 If external files or data are processed:<\/strong> Restrict Brotli decompression paths or temporarily suspend the related processing<\/p>\n\u203b Blocking request bodies alone may leave external server response or file processing paths exposed, so measures should be taken based on the actual decompression paths.<\/p>\n \u203b Access restrictions via firewalls and WAFs are supplementary measures only; applying the security patch is required for a fundamental fix.<\/p>\n \u203b If a Linux distribution or a separate vendor has backported the security fix, the patch may already be applied even if the Node.js version number is lower. Check the vendor\u2019s security advisories and package change history as well.<\/strong><\/p>\n\u25a0 Notes on Applying the Security Patch<\/strong><\/span><\/h2>\nThis vulnerability stems from a memory handling flaw in the Brotli decoder bundled with Node.js. It cannot be resolved by adding input validation to the application or by running a standard npm update alone.<\/p>\n Depending on your environment, the following actions are required:<\/p>\n \n- Environments using official Node.js distributions:<\/strong> Update to a Node.js runtime binary that includes the security patch<\/li>\n
- Environments that build Node.js from source:<\/strong> Rebuild and deploy using source code that includes the fix<\/li>\n
- Products or executables that bundle their own Node.js runtime:<\/strong> Check for and apply the security update provided by the product vendor<\/li>\n<\/ul>\n
In addition, since Brotli version information alone is not sufficient to accurately determine whether the patch has been applied, verification should be based on the official Node.js security release information or the vendor\u2019s patch history.<\/strong><\/p>\nSparrow SCA, our open-source analysis and management tool, automatically detects the Node2Shell (CVE-2026-111497) vulnerability for which immediate updates are recommended.<\/p>\n Sparrow Co., Ltd. is committed to actively supporting you in minimizing the impact of this vulnerability and maintaining stable service operations.<\/p>\n If you have any questions, please feel free to contact our customer service center at any time.<\/p>\n (Contact) Technical Support \/ Incidents: +82-2-6263-7411<\/strong><\/p>\n","protected":false},"featured_media":0,"template":"","class_list":["post-4371","news","type-news","status-publish","hentry"],"acf":[],"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/sparrow.im\/en\/wp-json\/wp\/v2\/news\/4371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sparrow.im\/en\/wp-json\/wp\/v2\/news"}],"about":[{"href":"https:\/\/sparrow.im\/en\/wp-json\/wp\/v2\/types\/news"}],"wp:attachment":[{"href":"https:\/\/sparrow.im\/en\/wp-json\/wp\/v2\/media?parent=4371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
|