"node2shell": a booby-trapped Brotli payload can take over Node.js apps
Crafted compressed data can trigger code execution on official builds, The Hacker News reports.
The Hacker News (@TheHackersNews) reported a remote code execution issue dubbed "node2shell." According to the post, specially crafted Brotli-compressed data can trigger code execution in vulnerable Node.js apps running an official build, with no runtime changes needed.
Brotli is a compression format widely used on the web, so code that automatically decompresses incoming data is a natural target. Remote code execution means an attacker could run their own commands on an affected server.
Why it mattersNode.js runs a huge number of web backends and APIs. If you maintain Node services, watch for official advisories and patched releases, and update promptly. The report follows the recent "php2shell" issue, part of a busy stretch for web platform security. The post had nearly 1,000 likes.
