Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder... Weiterlesen: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using…
Intelligence View
⚡ tsecurity.de Intelligence
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
12 Quellen
CVE-2026-98881 | Linux Kernel up to 6.18.52 Bridge Multicast br_multicast.c br_multicast_dev_del infinite loop (EUVD-2026-108675)
11 weitere Quellen
VVulDB Updatesvor 1 Std.CVE-2026-98882 | Linux Kernel up to 6.12.110/6.18.52 wave5 wave5-vpuapi.c wave5_vpu_dec_get_output_info frame_buf buffer overflow (EUVD-2026-108676) VVulDB Updatesvor 1 Std.CVE-2026-98880 | Linux Kernel up to 6.6.157/6.12.110/6.18.52 ntfs3 set_blocksize buffer overflow (EUVD-2026-108674) VVulDB Updatesvor 1 Std.CVE-2026-98879 | Linux Kernel up to 6.18.52 isofs set_blocksize buffer overflow (EUVD-2026-108673) VVulDB Updatesvor 1 Std.CVE-2026-98878 | Linux Kernel up to 6.18.52 irqchip-gic-v5 irq_eoi denial of service (EUVD-2026-108672) VVulDB Updatesvor 1 Std.CVE-2026-98877 | Linux Kernel up to 6.18.52 irqchip-gic-v4 __irq_domain_instantiate null pointer dereference (EUVD-2026-108723) VVulDB Updatesvor 1 Std.CVE-2026-98916 | Linux Kernel up to 6.6.159/6.12.113/6.18.52 nl80211 input validation (EUVD-2026-108872)
+5
9 Quellen
CVE-2026-16762 | Qt up to 4.2.x/6.8.8/6.11.1 QXmlStreamReader denial of service (EUVD-2026-108655)
8 weitere Quellen
VVulDB Updatesvor 3 Std.CVE-2026-25784 | Hallo Welt! BlueSpice up to 5.2.6 Token Authenticator LocalSettings.php mwsgTokenAuthenticatorServiceCIDR default permission (EUVD-2026-108653) VVulDB Updatesvor 3 Std.CVE-2026-25716 | Hallo Welt! BlueSpice up to 5.1.10/5.2.6 UserManager create unblockUser improper authorization (EUVD-2026-108651) VVulDB Updatesvor 2 Std.CVE-2026-105963 | elixir-plug plug/plug_crypto Plug.Crypto.verify/Plug.Crypto.secure_compare information disclosure (EUVD-2026-108666) VVulDB Updatesvor 2 Std.CVE-2026-89320 | Eclipse KeyPont HmacShaCryptor.Hash data authenticity (EUVD-2026-108654) BBSI Warn- und Informationsd…vor 3 Std.[NEU] [mittel] Red Hat Enterprise Linux iperf3: Schwachstelle ermöglicht Denial of Service BBSI Warn- und Informationsd…vor 3 Std.[NEU] [mittel] Qt Core QXmlStream parser: Schwachstelle ermöglicht Denial of Service
+2
8 Quellen
CVE-2025-30051 | CGM CLININET up to 2026.MS2 Configuration File SysIO.pl permission (EUVD-2025-211181)
7 weitere Quellen
VVulDB Updatesvor 4 Std.CVE-2025-30049 | CGM CLININET up to 2026.MS3 weak password hash (EUVD-2025-211179) VVulDB Updatesvor 4 Std.CVE-2025-30047 | CGM CLININET up to 2026.MS2 deserialization (EUVD-2025-211178) VVulDB Updatesvor 4 Std.CVE-2025-30050 | CGM CLININET up to 2026.MS2 RunCGI RunCGI.pm os command injection (EUVD-2025-211180) VVulDB Updatesvor 4 Std.CVE-2025-30045 | CGM CLININET up to 2026.MS3 ConvExpr code injection (EUVD-2025-211176) VVulDB Updatesvor 4 Std.CVE-2025-30046 | CGM CLININET up to 2026.MS3 HL7 Communication privileges management (EUVD-2025-211177) VVulDB Updatesvor 4 Std.CVE-2025-30043 | CGM CLININET up to 2026.MS2 missing authentication (EUVD-2025-211175)
+1
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4291954/it-security-nachrichten/researchers-demonstrate-node2shell-rce-exploit-on-nodejs-build-using-crafted-brotli-data/