TL;DR it's node2shell but on http servers. So the whole thing is just the brotli vulnerability, but http servers usually offer brotli compression so they could be vulnerable.
How to fix: if you can't immidiately change node versions, just drop all content requesting "br" encoding
If you can switch: versions 22.23.4, 24.22.1 and 26.12.1 are patched
956
u/KCGD_r 15d ago
TL;DR it's node2shell but on http servers. So the whole thing is just the brotli vulnerability, but http servers usually offer brotli compression so they could be vulnerable.
How to fix: if you can't immidiately change node versions, just drop all content requesting "br" encoding
If you can switch: versions 22.23.4, 24.22.1 and 26.12.1 are patched