{"id":24884,"date":"2026-10-26T10:46:53","date_gmt":"2026-10-26T01:46:53","guid":{"rendered":"https:\/\/sparrow.im\/kr\/?post_type=announcement&p=24884"},"modified":"2026-10-26T17:27:15","modified_gmt":"2026-10-26T08:27:15","slug":"node2shell-cve-2026-111497","status":"publish","type":"announcement","link":"https:\/\/sparrow.im\/kr\/info\/notice\/view\/20261026\/node2shell-cve-2026-111497\/","title":{"rendered":"Node.js \ubcf4\uc548 \ucde8\uc57d\uc810(Node2Shell) \uad00\ub828 \uc548\ub0b4(CVE-2026-111497)"},"content":{"rendered":"

\uc548\ub155\ud558\uc138\uc694, \uc2a4\ud328\ub85c\uc6b0\uc785\ub2c8\ub2e4.<\/p>\n

\ucd5c\uadfc Node.js\uc5d0\uc11c \uc11c\ube44\uc2a4 \uc911\ub2e8, \ud504\ub85c\uc138\uc2a4 \uba54\ubaa8\ub9ac \ub0b4 \uc815\ubcf4 \uc720\ucd9c \ub610\ub294 \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589(RCE)\uc73c\ub85c \uc774\uc5b4\uc9c8 \uc218 \uc788\ub294 \ubcf4\uc548 \ucde8\uc57d\uc810(CVE-2026-111497)\uc774 \uacf5\uac1c\ub418\uc5c8\uc2b5\ub2c8\ub2e4.<\/p>\n

‘Node2Shell’\ub85c \uc54c\ub824\uc9c4 \uc774\ubc88 \ucde8\uc57d\uc810\uc740 Node.js\uc5d0 \ud3ec\ud568\ub41c Brotli \ub77c\uc774\ube0c\ub7ec\ub9ac\uac00 \ube44\uc815\uc0c1\uc801\uc778 \uc555\ucd95 \ub370\uc774\ud130\ub97c \ud574\uc81c\ud558\ub294 \uacfc\uc815\uc5d0\uc11c, \ub0b4\ubd80 \ubc84\ud37c\uc5d0 \ud5c8\uc6a9\ub41c \ubc94\uc704\ub97c \ub118\uc5b4 \ub370\uc774\ud130\ub97c \uae30\ub85d\ud574 \ubc1c\uc0dd\ud558\ub294 \uacbd\uacc4 \ubc16 \uc4f0\uae30(Out-of-Bounds Write) <\/span>\ucde8\uc57d\uc810\uc785\ub2c8\ub2e4.<\/p>\n

\ucde8\uc57d\uc810 \uc545\uc6a9 \uc2dc \uc11c\ube44\uc2a4 \uc911\ub2e8, \uba54\ubaa8\ub9ac \ub0b4 \uc815\ubcf4 \uc720\ucd9c \ubc0f \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589 \ub4f1\uc758 \ubcf4\uc548 \uc704\ud611\uc774 \ubc1c\uc0dd\ud560 \uc218 \uc788\uc5b4 \uc601\ud5a5\uc744 \ubc1b\ub294 \ubc84\uc804\uc5d0 \ub300\ud55c \uc2e0\uc18d\ud55c \uc810\uac80\uacfc \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8\uac00 \uad8c\uace0\ub429\ub2c8\ub2e4.<\/p>\n

 <\/p>\n

\u25a0 \uac1c\uc694<\/strong><\/span><\/h2>\n

–\u00a0 CVE ID:<\/strong> CVE-2026-111497
\n–\u00a0 \uc2ec\uac01\ub3c4:<\/strong> \ub192\uc74c(HIGH) – Node.js \uacf5\uc2dd \ub4f1\uae09. \u201cBrotli decoder out-of-bounds write permits remote code execution\u201d
\n–\u00a0 \uc8fc\uc694 \uc704\ud5d8:<\/strong> \ucde8\uc57d\uc810 \uc545\uc6a9 \uc2dc \uc11c\ube44\uc2a4 \uc911\ub2e8, \ud504\ub85c\uc138\uc2a4 \uba54\ubaa8\ub9ac \ub0b4 \uc815\ubcf4 \uc720\ucd9c \ubc0f \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589(RCE) \uac00\ub2a5
\n–\u00a0 \uc601\ud5a5\uc744 \ubc1b\ub294 \ubc84\uc804 \ubc0f \ud328\uce58 \ubc84\uc804<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n
\uc81c\ud488\uba85<\/th>\n\uc601\ud5a5\uc744 \ubc1b\ub294 \ubc84\uc804<\/th>\n\ud328\uce58 \ubc84\uc804<\/th>\n<\/tr>\n<\/thead>\n
Node.js<\/td>\n22.23.4 \ubbf8\ub9cc<\/td>\n22.23.4 \uc774\uc0c1<\/td>\n<\/tr>\n
Node.js<\/td>\n24.22.1 \ubbf8\ub9cc<\/td>\n24.22.1 \uc774\uc0c1<\/td>\n<\/tr>\n
Node.js<\/td>\n26.12.1 \ubbf8\ub9cc<\/td>\n26.12.1 \uc774\uc0c1<\/td>\n<\/tr>\n
Google Brotlie \ub77c\uc774\ube0c\ub7ec\ub9ac<\/td>\n1.0.3 \uc774\uc0c1 1.0.10 \ubbf8\ub9cc<\/td>\n1.0.10<\/td>\n<\/tr>\n
Google Brotlie \ub77c\uc774\ube0c\ub7ec\ub9ac<\/td>\n1.1.0 \uc774\uc0c1 1.1.1 \ubbf8\ub9cc<\/td>\n1.1.1<\/td>\n<\/tr>\n
Google Brotlie \ub77c\uc774\ube0c\ub7ec\ub9ac<\/td>\n1.2.0 \uc774\uc0c1 1.2.1 \ubbf8\ub9cc<\/td>\n1.2.1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u203b Node.js 20.x \uc774\ud558 \ubc0f 23.x, 25.x \ub4f1 \uacf5\uc2dd \uc9c0\uc6d0\uc774 \uc885\ub8cc\ub41c \ubc84\uc804\uc740 \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8\uac00 \uc81c\uacf5\ub418\uc9c0 \uc54a\uc73c\ubbc0\ub85c \uc9c0\uc6d0 \uc911\uc778 \ubc84\uc804\uc73c\ub85c \uc5c5\uadf8\ub808\uc774\ub4dc\ud560 \uac83\uc744 \uad8c\uace0\ud569\ub2c8\ub2e4.<\/p>\n<\/div>\n

 <\/p>\n

\u25a0 \ucde8\uc57d\uc810 \uc601\ud5a5 \ubc0f \uacf5\uaca9 \uc870\uac74<\/strong><\/span><\/h2>\n

\ubcf8 \ucde8\uc57d\uc810\uc740 Node.js\uc5d0 \ud3ec\ud568\ub41c Brotli \ub77c\uc774\ube0c\ub7ec\ub9ac\uac00 \ube44\uc815\uc0c1\uc801\uc778 \uc555\ucd95 \ub370\uc774\ud130\ub97c \ud574\uc81c\ud560 \ub54c \ub0b4\ubd80 \ubc84\ud37c\uc5d0 \ud5c8\uc6a9\ub41c \ubc94\uc704\ub97c \ub118\uc5b4 \ub370\uc774\ud130\ub97c \uae30\ub85d\ud558\uc5ec \ubc1c\uc0dd\ud569\ub2c8\ub2e4.<\/p>\n

\uacf5\uaca9\uc790\uac00 \uc870\uc791\ud55c Brotli \uc555\ucd95 \ub370\uc774\ud130\ub97c \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc5d0 \uc804\ub2ec\ud558\uace0 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc774 \uc774\ub97c \ucde8\uc57d\ud55c \uc555\ucd95 \ud574\uc81c \uae30\ub2a5\uc73c\ub85c \ucc98\ub9ac\ud558\ub294 \uacbd\uc6b0, \ud504\ub85c\uc138\uc2a4 \uba54\ubaa8\ub9ac \uc190\uc0c1\uc73c\ub85c \uc778\ud55c \uc11c\ube44\uc2a4 \uc911\ub2e8 \ubc0f \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589 \ub4f1\uc758 \ud53c\ud574\uac00 \ubc1c\uc0dd\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n

\ub530\ub77c\uc11c \uc2e4\uc81c \uacf5\uaca9 \uac00\ub2a5\uc131\uc740 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ub610\ub294 \uc0ac\uc6a9 \uc911\uc778 \ub77c\uc774\ube0c\ub7ec\ub9ac\uc5d0 \uc678\ubd80\uc5d0\uc11c \uc804\ub2ec\ub41c Brotli \uc555\ucd95 \ub370\uc774\ud130\ub97c \ud574\uc81c\ud558\ub294 \uacbd\ub85c\uac00 \uc788\ub294\uc9c0\uc5d0 \ub530\ub77c \ub2ec\ub77c\uc9c0\ubbc0\ub85c\u00a0\ub2e4\uc74c\uacfc \uac19\uc740 \ucc98\ub9ac \uacbd\ub85c\ub97c \uc810\uac80\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n

–\u00a0 Brotli\ub85c \uc555\ucd95\ub41c HTTP \uc694\uccad \ub370\uc774\ud130\ub97c \ucc98\ub9ac\ud558\ub294 \uacbd\uc6b0
\n–\u00a0 \uc678\ubd80 \uc11c\ubc84\uc5d0\uc11c \uc804\ub2ec\ubc1b\uc740 \uc555\ucd95 \uc751\ub2f5\uc744 \uc790\ub3d9\uc73c\ub85c \ud574\uc81c\ud558\ub294 \uacbd\uc6b0
\n–\u00a0 \uc5c5\ub85c\ub4dc \ud30c\uc77c \ub610\ub294 \uc678\ubd80 \ub370\uc774\ud130\ub97c Brotli \ubc29\uc2dd\uc73c\ub85c \uc555\ucd95 \ud574\uc81c\ud558\ub294 \uacbd\uc6b0<\/p>\n

\uad00\ub828 \uae30\ub2a5\uc5d0\ub294 node:zlib \ubaa8\ub4c8\uc758 brotliDecompress(), brotliDecompressSync(), createBrotliDecompress() \ub4f1\uc774 \uc788\uc2b5\ub2c8\ub2e4.<\/span><\/div>\n
\n
\uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc774 \uc9c1\uc811 \ud638\ucd9c\ud558\uc9c0 \uc54a\ub354\ub77c\ub3c4 \ubbf8\ub4e4\uc6e8\uc5b4\ub098 HTTP \ud074\ub77c\uc774\uc5b8\ud2b8 \ub77c\uc774\ube0c\ub7ec\ub9ac\uac00 \ub0b4\ubd80\uc801\uc73c\ub85c \uc0ac\uc6a9\ud560 \uc218 \uc788\uc73c\ubbc0\ub85c \ud568\uaed8 \ud655\uc778\ud574\uc57c \ud569\ub2c8\ub2e4.<\/span><\/div>\n<\/div>\n

 <\/p>\n

\u25a0 \ucde8\uc57d\uc810 \ud655\uc778 \ubc29\ubc95<\/strong><\/span><\/h2>\n
\n
\ud574\ub2f9 \ucde8\uc57d\uc810\uc740 Node.js\uc5d0 \ud3ec\ud568\ub41c \ub124\uc774\ud2f0\ube0c Brotli \ub77c\uc774\ube0c\ub7ec\ub9ac\uc5d0\uc11c \ubc1c\uc0dd\ud558\ubbc0\ub85c, \uc2e4\uc81c \uc11c\ube44\uc2a4\uac00 \uc0ac\uc6a9\ud558\ub294 Node.js \ubc84\uc804\uacfc \ubcf4\uc548 \ud328\uce58 \uc801\uc6a9 \uc5ec\ubd80\ub97c \ud655\uc778\ud574\uc57c \ud569\ub2c8\ub2e4.<\/span><\/div>\n<\/div>\n

\u2460 Node.js \ubc84\uc804 \ud655\uc778<\/strong><\/span><\/h3>\n

Windows \ubc0f Linux \ud658\uacbd\uc5d0\uc11c \uba85\ub839 \ud504\ub86c\ud504\ud2b8 \ub610\ub294 \ud130\ubbf8\ub110\uc744 \uc2e4\ud589\ud55c \ud6c4 \ub2e4\uc74c \uba85\ub839\uc5b4\ub97c \uc785\ub825\ud569\ub2c8\ub2e4.<\/p>\n

–\u00a0 \ud655\uc778 \uba85\ub839\uc5b4<\/strong><\/p>\n

node -v<\/code><\/pre>\n
–\u00a0 \uc2e4\ud589 \uacb0\uacfc \uc608\uc2dc<\/strong><\/p>\n
v22.23.3<\/code><\/pre>\n
\uc704 \uacb0\uacfc\ub294 Node.js 22.23.3 \ubc84\uc804\uc774 \uc124\uce58\ub418\uc5b4 \uc788\uc74c\uc744 \uc758\ubbf8\ud569\ub2c8\ub2e4. \ud574\ub2f9 \ubc84\uc804\uc740 \ubcf4\uc548 \uc218\uc815 \ubc84\uc804\uc778 22.23.4 \uc774\uc804 \ubc84\uc804\uc73c\ub85c, \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8\uac00 \ud544\uc694\ud569\ub2c8\ub2e4.<\/p>\n
 <\/p>\n
\u2461 Node.js \uc2e4\ud589 \ud30c\uc77c \uc704\uce58 \ud655\uc778<\/strong><\/span><\/h3>\n
–\u00a0 Windows<\/strong><\/p>\n
where.exe node<\/code><\/pre>\n
–\u00a0 Linux<\/strong><\/p>\n
command -v node<\/code><\/pre>\n
\ud604\uc7ac \uba85\ub839\ud589\uc5d0\uc11c \uc2e4\ud589\ub418\ub294 Node.js\uc758 \uacbd\ub85c\ub294 \ub2e4\uc74c \uba85\ub839\uc5b4\ub85c\ub3c4 \ud655\uc778\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n
node -p \"process.execPath\"<\/code><\/pre>\n
\ub2e8, \uc704 \uba85\ub839\uc5b4\ub294 \ud604\uc7ac \uba85\ub839\ud589\uc5d0\uc11c \uc0ac\uc6a9\ud558\ub294 Node.js\ub97c \ud655\uc778\ud558\ub294 \ubc29\ubc95\uc785\ub2c8\ub2e4. \uc2e4\uc81c \uc11c\ube44\uc2a4\ub294 \ubcc4\ub3c4\uc758 \uc124\uce58 \uacbd\ub85c, \ubc84\uc804 \uad00\ub9ac\uc790, \uc11c\ube44\uc2a4 \uacc4\uc815 \ub610\ub294 \ucee8\ud14c\uc774\ub108\uc5d0 \ud3ec\ud568\ub41c Node.js\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n
\ub530\ub77c\uc11c \uc11c\ube44\uc2a4 \uc2e4\ud589 \uc124\uc815\uacfc \ucee8\ud14c\uc774\ub108 \ub0b4\ubd80 \ubc84\uc804\uc744 \ubcc4\ub3c4\ub85c \ud655\uc778\ud574\uc57c \ud569\ub2c8\ub2e4. \ud544\uc694\ud55c \uacbd\uc6b0 \uc2e4\uc81c \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ud504\ub85c\uc138\uc2a4\uc5d0\uc11c process.version<\/code>\uacfc process.execPath<\/code>\ub97c \ub0b4\ubd80 \uc9c4\ub2e8 \ub85c\uadf8\ub85c \ud655\uc778\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n
\u2462 Brotli \uc555\ucd95 \ud574\uc81c \uacbd\ub85c \ud655\uc778<\/strong><\/span><\/h3>\n
\uc560\ud50c\ub9ac\ucf00\uc774\uc158\uacfc \uc0ac\uc6a9 \ub77c\uc774\ube0c\ub7ec\ub9ac\uc5d0\uc11c Brotli \uc555\ucd95 \ud574\uc81c \uae30\ub2a5\uc758 \uc0ac\uc6a9 \uc5ec\ubd80\ub97c \ud655\uc778\ud558\uace0, \uc678\ubd80 \uc785\ub825\uc774 \ud574\ub2f9 \uae30\ub2a5\uae4c\uc9c0 \uc804\ub2ec\ub418\ub294\uc9c0 \uc810\uac80\ud574\uc57c \ud569\ub2c8\ub2e4.\u00a0\ubc84\uc804 \ud655\uc778\uc740 \ud328\uce58 \ud544\uc694 \uc5ec\ubd80\ub97c \ud310\ub2e8\ud558\ub294 \uae30\uc900\uc774\uba70, \uc555\ucd95 \ud574\uc81c \uacbd\ub85c \uc810\uac80\uc740 \uc2e4\uc81c \uc11c\ube44\uc2a4\uc758 \ub178\ucd9c \uac00\ub2a5\uc131\uc744 \ud310\ub2e8\ud558\uae30 \uc704\ud55c \uc808\ucc28\uc785\ub2c8\ub2e4.<\/p>\n
 <\/p>\n
\u25a0 \uc870\uce58 \ubc29\uc548<\/strong><\/span><\/h2>\n
\u2714\ufe0f \uc6b4\uc601 \ud658\uacbd \uc810\uac80<\/strong><\/span><\/h3>\n
–\u00a0 Node.js \uc124\uce58 \uc5ec\ubd80 \ubc0f \uc0ac\uc6a9 \ubc84\uc804 \ud655\uc778, \ucde8\uc57d \ubc84\uc804 \uc0ac\uc6a9 \uc5ec\ubd80 \uc810\uac80
\n–\u00a0 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ubc0f \uc0ac\uc6a9 \ub77c\uc774\ube0c\ub7ec\ub9ac\uc758 Brotli \uc555\ucd95 \ud574\uc81c \uae30\ub2a5 \uc0ac\uc6a9 \uc5ec\ubd80 \ud655\uc778<\/p>\n
\u2714\ufe0f \ubcf4\uc548 \ud328\uce58 \uc5c5\ub370\uc774\ud2b8(*\uc0c1\uae30 \ud45c \ucc38\uace0)<\/strong><\/span><\/h3>\n
–\u00a0 Node.js 22.x, 24.x, 26.x\ub294 \uac01 \ubc84\uc804\uc5d0 \ud574\ub2f9\ud558\ub294 \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8 \uc801\uc6a9
\n–\u00a0 \uacf5\uc2dd \uc9c0\uc6d0\uc774 \uc885\ub8cc\ub41c Node.js \ubc84\uc804\uc740 \ubcf4\uc548 \ud328\uce58\uac00 \uc801\uc6a9\ub41c \uc9c0\uc6d0 \ubc84\uc804\uc73c\ub85c \uc5c5\uadf8\ub808\uc774\ub4dc \uad8c\uace0
\n–\u00a0 \uc5c5\ub370\uc774\ud2b8 \uc774\ud6c4 \uc11c\ube44\uc2a4 \uc7ac\uc2dc\uc791 \ubc0f \uc2e4\uc81c \uc2e4\ud589 \ud658\uacbd\uc5d0 \ud328\uce58 \ubc84\uc804\uc774 \uc801\uc6a9\ub418\uc5c8\ub294\uc9c0 \ud655\uc778
\n–\u00a0 \ucee8\ud14c\uc774\ub108 \ud658\uacbd\uc5d0\uc11c\ub294 \uc218\uc815\ub41c Node.js\uac00 \ud3ec\ud568\ub41c \uc774\ubbf8\uc9c0\ub85c \uc7ac\ube4c\ub4dc \ub610\ub294 \uad50\uccb4 \ud6c4 \uc7ac\ubc30\ud3ec<\/p>\n
\u2714\ufe0f \uc989\uc2dc \uc5c5\ub370\uc774\ud2b8\uac00 \uc5b4\ub824\uc6b4 \uacbd\uc6b0<\/strong><\/span><\/h3>\n
\ubcf4\uc548 \ud328\uce58\ub97c \uc989\uc2dc \uc801\uc6a9\ud558\uae30 \uc5b4\ub824\uc6b4 \uacbd\uc6b0, \uacf5\uaca9\uc790\uac00 \uc81c\uacf5\ud55c Brotli \ub370\uc774\ud130\uac00 \ucde8\uc57d\ud55c \uc555\ucd95 \ud574\uc81c \uae30\ub2a5\uc5d0 \ub3c4\ub2ec\ud558\uc9c0 \uc54a\ub3c4\ub85d \ub2e4\uc74c\uacfc \uac19\uc740 \uc784\uc2dc \uc870\uce58\ub97c \uad8c\uace0\ud569\ub2c8\ub2e4.<\/p>\n
\u2013 Brotli \uc555\ucd95 \uc694\uccad\uc744 \ucc98\ub9ac\ud558\ub294 \uacbd\uc6b0<\/strong>: \uc555\ucd95 \ud574\uc81c \uc774\uc804 \ub2e8\uacc4\uc5d0\uc11c Brotli \uc555\ucd95 \uc694\uccad\uc744 \ucc28\ub2e8\ud558\uac70\ub098 \uad00\ub828 \uae30\ub2a5 \uc77c\uc2dc \uc911\ub2e8
\n\u2013 \uc678\ubd80 HTTP \uc751\ub2f5\uc744 \uc555\ucd95 \ud574\uc81c\ud558\ub294 \uacbd\uc6b0:<\/strong> \ud074\ub77c\uc774\uc5b8\ud2b8 \ub77c\uc774\ube0c\ub7ec\ub9ac\uc758 Brotli \uc790\ub3d9 \uc555\ucd95 \ud574\uc81c \uae30\ub2a5 \ube44\ud65c\uc131\ud654 \uac80\ud1a0
\n\u2013 \uc678\ubd80 \ud30c\uc77c\uc774\ub098 \ub370\uc774\ud130\ub97c \ucc98\ub9ac\ud558\ub294 \uacbd\uc6b0:<\/strong> Brotli \uc555\ucd95 \ud574\uc81c \uacbd\ub85c \uc81c\ud55c \ub610\ub294 \uad00\ub828 \ucc98\ub9ac \uae30\ub2a5 \uc77c\uc2dc \uc911\ub2e8<\/p>\n
\u203b \uc694\uccad \ubcf8\ubb38\ub9cc \ucc28\ub2e8\ud558\uba74 \uc678\ubd80 \uc11c\ubc84 \uc751\ub2f5\uc774\ub098 \ud30c\uc77c \ucc98\ub9ac \uacbd\ub85c\ub294 \ub0a8\uc744 \uc218 \uc788\uc73c\ubbc0\ub85c, \uc2e4\uc81c \uc555\ucd95 \ud574\uc81c \uacbd\ub85c\ub97c \uae30\uc900\uc73c\ub85c \uc870\uce58\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n
\u203b \ubc29\ud654\ubcbd \ubc0f WAF\ub97c \ud1b5\ud55c \uc811\uadfc \uc81c\ud55c\uc740 \ubcf4\uc870\uc801\uc778 \ub300\uc751 \ubc29\uc548\uc774\uba70, \uadfc\ubcf8\uc801\uc778 \ud574\uacb0\uc744 \uc704\ud574\uc11c\ub294 \ubcf4\uc548 \ud328\uce58 \uc801\uc6a9\uc774 \ud544\uc694\ud569\ub2c8\ub2e4.<\/p>\n
\u203b Linux \ubc30\ud3ec\ud310 \ub610\ub294 \ubcc4\ub3c4 \uacf5\uae09\uc5c5\uccb4\uc5d0\uc11c \ubcf4\uc548 \uc218\uc815 \uc0ac\ud56d\uc744 \ubc31\ud3ec\ud2b8\ud55c \uacbd\uc6b0, Node.js \ubc84\uc804\uc774 \ub0ae\ub354\ub77c\ub3c4 \ud328\uce58\uac00 \uc801\uc6a9\ub418\uc5c8\uc744 \uc218 \uc788\uc73c\ubbc0\ub85c \uacf5\uae09\uc5c5\uccb4\uc758 \ubcf4\uc548 \uacf5\uc9c0 \ubc0f \ud328\ud0a4\uc9c0 \ubcc0\uacbd \uc774\ub825\uc744 \ud568\uaed8 \ud655\uc778\ud574\uc57c \ud569\ub2c8\ub2e4.<\/strong><\/p>\n
 <\/p>\n
\u25a0 \ubcf4\uc548 \ud328\uce58 \uc801\uc6a9 \uc2dc \uc720\uc758\uc0ac\ud56d<\/strong><\/span><\/h2>\n
\ubcf8 \ucde8\uc57d\uc810\uc740 Node.js\uc5d0 \ud3ec\ud568\ub41c Brotli \ub514\ucf54\ub354\uc758 \uba54\ubaa8\ub9ac \ucc98\ub9ac \uacb0\ud568\uc73c\ub85c \ubc1c\uc0dd\ud558\uba70, \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc5d0 \uc785\ub825 \uac80\uc99d\uc744 \ucd94\uac00\ud558\uac70\ub098 \uc77c\ubc18\uc801\uc778 npm update<\/code>\ub9cc\uc73c\ub85c\ub294 \ud574\uacb0\ub418\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.<\/p>\n
\ub530\ub77c\uc11c \uc0ac\uc6a9 \ud658\uacbd\uc5d0 \ub530\ub77c \ub2e4\uc74c\uacfc \uac19\uc740 \uc870\uce58\uac00 \ud544\uc694\ud569\ub2c8\ub2e4.<\/p>\n
– Node.js \uacf5\uc2dd \ubc30\ud3ec\ubcf8\uc744 \uc0ac\uc6a9\ud558\ub294 \ud658\uacbd:<\/strong> \ubcf4\uc548 \ud328\uce58\uac00 \uc801\uc6a9\ub41c Node.js \uc2e4\ud589 \ubc14\uc774\ub108\ub9ac\ub85c \uc5c5\ub370\uc774\ud2b8
\n– Node.js\ub97c \uc18c\uc2a4\ucf54\ub4dc\uc5d0\uc11c \uc9c1\uc811 \ube4c\ub4dc\ud558\ub294 \ud658\uacbd:<\/strong> \uc218\uc815 \uc0ac\ud56d\uc774 \ud3ec\ud568\ub41c \uc18c\uc2a4\ucf54\ub4dc\ub97c \uc0ac\uc6a9\ud574 \uc7ac\ube4c\ub4dc \ubc0f \ubc30\ud3ec
\n– \ubcc4\ub3c4 Node.js \ub7f0\ud0c0\uc784\uc744 \ud3ec\ud568\ud558\ub294 \uc81c\ud488\uc774\ub098 \uc2e4\ud589 \ud30c\uc77c\uc744 \uc0ac\uc6a9\ud558\ub294 \uacbd\uc6b0:<\/strong> \ud574\ub2f9 \uc81c\ud488 \uacf5\uae09\uc5c5\uccb4\uc758 \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8 \ud655\uc778 \ubc0f \uc801\uc6a9<\/p>\n
\ub610\ud55c Brotli \ubc84\uc804 \uc815\ubcf4\ub9cc\uc73c\ub85c\ub294 \ud328\uce58 \uc801\uc6a9 \uc5ec\ubd80\ub97c \uc815\ud655\ud558\uac8c \ud310\ub2e8\ud558\uae30 \uc5b4\ub824\uc6b0\ubbc0\ub85c, Node.js \uacf5\uc2dd \ubcf4\uc548 \ub9b4\ub9ac\uc2a4 \uc815\ubcf4 \ub610\ub294 \uacf5\uae09\uc5c5\uccb4\uc758 \ud328\uce58 \ub0b4\uc5ed\uc744 \uae30\uc900\uc73c\ub85c \ud655\uc778<\/strong>\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n
 <\/p>\n
\uc624\ud508\uc18c\uc2a4 \ubd84\uc11d \ubc0f \uad00\ub9ac \ub3c4\uad6c\uc778 Sparrow SCA\ub294 \uc989\uac01 \uc5c5\ub370\uc774\ud2b8\uac00 \uad8c\uace0\ub41c Node2Shell(CVE-2026-111497) \ucde8\uc57d\uc810\uc744 \uc790\ub3d9 \ud0d0\uc9c0\ud569\ub2c8\ub2e4.<\/p>\n
\uc2a4\ud328\ub85c\uc6b0\ub294 \uc774\ubc88 \ucde8\uc57d\uc810\uc73c\ub85c \uc778\ud55c \uadc0\uc0ac\uc758 \ud53c\ud574\ub97c \ucd5c\uc18c\ud654\ud558\uace0 \uc548\uc815\uc801 \uc11c\ube44\uc2a4 \uc6b4\uc601\uc744 \uc704\ud574 \uc801\uadf9 \uc9c0\uc6d0\ud558\uaca0\uc2b5\ub2c8\ub2e4.<\/p>\n
 <\/p>\n
\uad81\uae08\ud558\uc2e0 \uc810\uc740 \uc5b8\uc81c\ub4e0\uc9c0 \uace0\uac1d\uc13c\ud130\ub85c \ubb38\uc758 \uc8fc\uc2dc\uae30 \ubc14\ub78d\ub2c8\ub2e4.<\/p>\n
(\ubb38\uc758) \uae30\uc220\/\uc7a5\uc560 02-6263-7411<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"
\uc548\ub155\ud558\uc138\uc694, \uc2a4\ud328\ub85c\uc6b0\uc785\ub2c8\ub2e4. \ucd5c\uadfc Node.js\uc5d0\uc11c \uc11c\ube44\uc2a4 \uc911\ub2e8, \ud504\ub85c\uc138\uc2a4 \uba54\ubaa8\ub9ac \ub0b4 \uc815\ubcf4 \uc720\ucd9c \ub610\ub294 \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589(RCE)\uc73c\ub85c \uc774\uc5b4\uc9c8 \uc218 \uc788\ub294 \ubcf4\uc548 \ucde8\uc57d\uc810(CVE-2026-111497)\uc774 \uacf5\uac1c\ub418\uc5c8\uc2b5\ub2c8\ub2e4. ‘Node2Shell’\ub85c \uc54c\ub824\uc9c4 \uc774\ubc88 \ucde8\uc57d\uc810\uc740 Node.js\uc5d0 \ud3ec\ud568\ub41c Brotli \ub77c\uc774\ube0c\ub7ec\ub9ac\uac00 \ube44\uc815\uc0c1\uc801\uc778 \uc555\ucd95 \ub370\uc774\ud130\ub97c \ud574\uc81c\ud558\ub294 \uacfc\uc815\uc5d0\uc11c, \ub0b4\ubd80 \ubc84\ud37c\uc5d0 \ud5c8\uc6a9\ub41c \ubc94\uc704\ub97c \ub118\uc5b4 \ub370\uc774\ud130\ub97c \uae30\ub85d\ud574 \ubc1c\uc0dd\ud558\ub294 \uacbd\uacc4 \ubc16 \uc4f0\uae30(Out-of-Bounds Write) \ucde8\uc57d\uc810\uc785\ub2c8\ub2e4. \ucde8\uc57d\uc810 \uc545\uc6a9 \uc2dc \uc11c\ube44\uc2a4 \uc911\ub2e8, \uba54\ubaa8\ub9ac \ub0b4 \uc815\ubcf4 […]<\/p>\n","protected":false},"featured_media":0,"template":"","class_list":["post-24884","announcement","type-announcement","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/sparrow.im\/kr\/wp-json\/wp\/v2\/announcement\/24884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sparrow.im\/kr\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/sparrow.im\/kr\/wp-json\/wp\/v2\/types\/announcement"}],"wp:attachment":[{"href":"https:\/\/sparrow.im\/kr\/wp-json\/wp\/v2\/media?parent=24884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}