Nangabe i-app, iwebhusayithi, sitolo se-inthanethi nobe i-API yenkampani yakho kwakhiwe nge-Node.js, kufaka ekhatsi emawebhusayithi e-Next.js nemaseva langemuva lakhiwe nge-Express nobe nge-NestJS, cela umakhi wakho wesofthiwe namuhla kutsi abuyekete i-Node.js iye kunguculo 22.23.4, 24.22.1 nobe 26.12.1, bese aphindze akhe futsi acalise iseva kabusha. Iphrojekthi ye-Node.js yakhipha letinguculo mhla ti-21 Imphala 2026 kuze ivale sikhala lesatiwa ngekutsi yi-Node2Shell (CVE-2026-111497), lesilinganiswe nga-9.2 kulokungu-10, lesivumela umhlaseli longenayo nanobe nguyiphi iphasiwedi kutsi asebentise ikhodi kuseva yakho ngekutfumela idatha lecindzetelwe leyakhiwe ngebucili. Siphatsimandla Savelonkhe Sekuphepha kwe-Inthanethi saseSaudi Arabia (NCA) sakhipha secwayiso sesigaba «lesisetulu kakhulu», futsi mhla ti-27 Imphala i-ejensi yaseMelika yekuphepha kwe-inthanethi, CISA, yaciniseka kutsi lesikhala sisetjentiswa ekuhlaseleni kwangempela.

Kwenteke ini ngco?

Sikhala sise-Brotli, indlela yekucindzetela idatha lesetjentiswa ngemaseva e-web nema-browser kuze anciphise idatha lahwebelana ngayo, futsi i-Node.js iphatsa ikhophi yayo ye-decoder ye-Brotli leyakhiwa ngu-Google. Ngekusho kwesecwayiso sekuphepha se-Node.js, idatha lecindzetelwe lenephutsa yenta i-decoder ibhale ngale kwekuphela kwe-buffer yangekhatsi, loko lokungenta i-app iwe, kuvete lokusenkhumbulweni yayo, nobe kuvumele umhlaseli kutsi asebentise ikhodi. Lesecwayiso sitsi lesikhala sabikwa licembu le-Codex Security le-OpenAI, futsi lokukhishwa lokufanako kwalungisa tikhala letingu-10 sekukonkhe, letingu-4 tato tisezingeni leliphakeme.

Ngemuva kwaloko tintfo tahamba ngekushesha. Mhla ti-22 Imphala, lilanga linye ngemuva kwekulungiswa, i-Red Team ye-Imperva yasebentisa ikhodi ku-image lesemtsetfweni ye-Node.js 24.22.0 ngetindlela letimbili tamalanga onkhe: umsebenti lowakhelwe ngekhatsi i-fetch() kanye nemitimba yeticelo lephatfwa yi-Express 5. Mhla ti-26 Imphala, i-ELLIO yabhala phansi lokuhamba kwedatha kwekuhlasela kwangempela lokuphetse ikhodi yekuhlasela lesidlangalaleni. Mhla ti-27 Imphala, i-CISA yengeta lesikhala kuluhlu lwayo lwetikhala letisetjentiswa ngempela.

Liphutsa lucobo lwalo lidzala. Ngekusho kwelirekhodi le-CVE, litsintsa tinguculo te-Brotli kusukela ku-1.0.3 kuya ku-1.2.0, futsi i-OpenAI itsi imbangela yalo yalungiswa ekhodini yemtfombo ye-Brotli ngenyanga yeNdlovana 2026 kungekho muntfu lowatiko kutsi kusikhala sekuphepha, futsi ngaphandle kwenguculo lensha, kwate kwakhishwa i-Brotli 1.2.1 mhla ti-21 Imphala. Nangabe loku kuvakala kwatiwa, kunjalo: ngelisonto leliphelile sabhala nge-PHP2Shell, sikhala lesavula emaseva e-PHP ne-WordPress. I-Node2Shell yingoti yeluhlobo lolufanako kuma-app lakhiwe nge-JavaScript.

I-app yami itsintsekile yini?

I-Node.js isebentisa luhlangotsi lweseva lwengcenye lenkhulu yemawebhusayithi esimanje, emaseva langemuva ema-app eselula, emadeshibhodi nema-API. Nangabe luhlelo lwakho lwakhiwa eminyakeni lembalwa leyendlulile yi-ejensi nobe ngumakhi wesofthiwe lozimele, kungenteka kakhulu kutsi lusebenta nge-Node.js ungati. Emagatja latsintsekile ngu-22.x, 24.x na-26.x langaphambi kwetinguculo letilungisiwe, kanye nemagatja lasaphelelwe kusekelwa 20.x, 23.x na-25.x, lokutsi ngekusho kwephrojekthi ye-Node.js ahlale atsintsekile futsi angeke atfole kulungiswa.

Kusebentisa i-Node.js kuphela akusho kutsi usengotini: kufanele kube nalokutsite lokudlulisela idatha yemhlaseli ku-decoder. Bacwaningi babala tindlela letintsatfu letijwayelekile:

  • Ticelo letingenako letincindzetelwe. Ema-parser emitimba yeticelo ku-Express 5, body-parser 2 na-Koa avula ngekutenta imitimba yeticelo lecindzetelwe nge-Brotli, ngisho nangaphambi kwekutsi ikhodi yakho isebente.
  • Lokucuketfwe iseva yakho lekulandako. Nangabe i-app yakho ivula ema-link langaphandle, njengekubuka kucala kwema-link, ema-webhook, ema-crawler nobe emajenti e-AI lafundza emakhasi e-web, iwebhusayithi lenebutsa ingaphendvula ngedatha lecindzetelwe lenetjefu. Umsebenti lowakhelwe ngekhatsi i-fetch() ku-Node, i-axios neticelo letisohlangotsini lweseva kuma-framework lafana ne-Next.js kuyivula ngekutenta.
  • Emafayela lalayishwa basebentisi. Nanobe nguyiphi ikhodi levula idatha ye-Brotli letfunyelwe likhasimende nobe sivakashi.

Ingoti yeca i-Node.js. Secwayiso se-NCA sibala ne-Python, i-Bun ne-Envoy, futsi i-Microsoft yakhipha kulungiswa mhla ti-25 Imphala kwe-.NET 8, 9, 10 na-11, Visual Studio 2019, 2022 na-2026, kanye ne-PowerShell 7.4 kuya ku-7.6, yalinganisa lesikhala ngekutsi sibucayi ku-.NET, yasinika kuhlolwa kwa-«Exploitation More Likely». I-Microsoft itsi kuvulwa kwe-Brotli akuvulwanga ngekwakhiwa ku-.NET, ngako tinhlelo letikuvulile kuphela letisengotini.

Nangabe iwebhusayithi yakho ibanjwe ku-Vercel, lenkampani itsi esecwayisweni sayo ngalo lilanga i-Node.js lekhipha ngalo kulungiswa, yafaka imitsetfo ye-firewall levimba indlela yekuhlasela lengenako kuto tonkhe tiphrojekthi, nekutsi kusukela mhla ti-28 Imphala konkhe kufakwa lokusha kusebentisa i-Node.js lelungisiwe. Tiphrojekthi letikhona tidzinga kuphindze tifakwe, futsi tiphrojekthi letisolo tisebentisa i-Node.js 20 kufanele tiye ku-22 nobe ku-24.

Lokufanele ukwente namuhla: tinyatselo letisihlanu

  1. Buta umbuto munye ngekubhala. Ngiyiphi inguculo ye-Node.js lesebenta emasevenini etfu nangekhatsi kwema-image etfu e-Docker? Cela umakhi wakho wesofthiwe kutsi ahlole inombolo yenguculo ye-Node.js ngemyalo node -v. Ungatsembeli kunombolo yenguculo ye-Brotli: i-ELLIO yatfola kutsi ikhombisa 1.2.0 kuto tombili tinguculo letilungisiwe naletingakalungiswa.
  2. Buyeketa uye kunguculo lelungisiwe. 22.23.4, 24.22.1 nobe 26.12.1. Nangabe usaku-20.x, 23.x nobe 25.x, yiya eligatjeni lelisekelwako njenge-22 nobe i-24, bese uyahlola ngaphambi kwekuyisebentisa.
  3. Phindze wakhe futsi ucalise kabusha. Inchubo lesebentako igcina ikhodi lendzala. Phindze wakhe ema-image e-container phezu kwe-image yesisekelo lelungisiwe, ngobe i-Dockerfile lebekwe ku-24.22.0 itawuchubeka isabalalisa inguculo lesengotini kute kube nalotsite loshintja lowo mugca. Hlola nemaseva ekuhlola, emapayipi ekwakha nemisebenti lengenaseva.
  4. Buyeketa letinye tikhophi. Emaphakheji e-Python i-Brotli ne-brotlicffi (tinguculo 1.2.1 na-1.2.1.0), i-Bun, i-Envoy, umtapo we-Brotli ku-Linux yakho, kanye ne-.NET ngekubuyeketa kwe-Microsoft kwamhla ti-25 Imphala.
  5. Hlola ema-log nemafayela ekuwa. Funa ticelo letincindzetelwe nge-Brotli letinkhulu ngendlela lengakavami, netinchubo letiwa kaninyenti. I-ELLIO iyecwayisa kutsi kuhlasela lokunyenti lokungaphumeleli kuwisa inchubo, nekutsi lifayela lekuwa lingagcina ema-cookie e-session nemakhiye etivakashi, ngako-ke beka imingcele kulabo labangafundza emafayela ekuwa (core dumps) nasesikhatsini lowagcina ngaso.

Nangabe ungeke ukhone kubuyeketa namuhla

Njengesinyatselo sesikhashana, vimba ticelo letingenako letinesihloko Content-Encoding: br eseveni yakho yangaphambili nobe ku-firewall yakho, nangabe i-app yakho ingatidzingi. I-Vercel ne-Imperva tengete imitsetfo ye-firewall yalesikhala, kodvwa i-Vercel ngayo igcizelela kutsi i-firewall ayihlanganisi timphendvulo iseva yakho letilanda kulamanye emawebhusayithi: kubuyeketa i-Node.js kuphela lokuvala leyo ndlela. Tsatsa nobe nguyiphi indlela yekuvikela njengesikhatsi lesengetiwe, hhayi njengendlela levala sikhundla kubuyeketa.

Umbono we-Origami

Tikhala letimbili letibucayi esisekelweni se-web enyangeni yinye, kucala i-PHP2Shell bese kuba yi-Node2Shell, tisitjela indzaba lecacile: ikhodi lebhalwe licembu lakho ingahle ilunge kantsi indzawo leyisebentisako ngaphansi kwayo ivulekile. Kulungiswa kwe-Node2Shell kwahlala ekhodini yemtfombo ye-Brotli cishe tinyanga letisiphohlongo ngaphambi kwekutsi umuntfu acondze kutsi kuyinkinga yekuphepha, futsi ngekushesha nje imininingwane isidalulwe, bacwaningi badzinga lilanga linye kuze basebentise ikhodi kunguculo lesemtsetfweni. Lesivame kusibona etinkampanini letinyenti yi-app leyanikwa eminyakeni leyendlulile, kungekho muntfu lophetse kubuyeketwa kwayo, futsi kungekho luhlu lwetindzawo lapho i-Node.js isebenta khona ngempela. Nangabe kunjalo kuwe, cala lolo luhlu namuhla. Ku-Origami sakha ema-app e-web netinhlelo, letinyenti tato tisebenta nge-Node.js ne-Next.js, futsi silandzelela kubuyeketwa kwendzawo yato kusukela ngelilanga lekucala. Nangabe ufuna kutsi i-app yakho ihlolwe nobe i-Node.js ibuyeketwe ngaphandle kwekuma kwemsebenti, sitsintse.

Imitfombo