Node.js Brotli Decoder RCE (October 2026 Security Release): Detection, Patching, and Hardening Guide for 22.x, 24.x, and 26.x

---
title: Node.js Process Spawning Shell or Command Interpreter
id: 3f8a2c71-9b4e-4d6a-a1c8-7e2f5b0d9c3a
status: experimental
description: Detects node.exe spawning cmd, PowerShell, or script interpreters — a strong post-exploitation indicator following remote code execution against a Node.js service such as the Brotli decompression RCE.
references:
  - https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Build tooling and npm lifecycle scripts spawning shells on developer workstations — restrict deployment to servers/VDI exclusions
  - PM2 or process managers that wrap node with cmd on misconfigured deployments
level: high
---
title: Linux Node Process Spawning Interactive Shell
id: 8c1d4e62-2a7f-4b39-9d5c-4f6a8e1b7d02
status: experimental
description: Detects a node process spawning an interactive shell or common post-exploitation utility on Linux — consistent with successful exploitation of a Node.js service vulnerability such as the bundled Brotli decoder RCE.
references:
  - https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/nodejs'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - npm scripts and CI/CD pipelines executing shells from node — scope this rule to production hosts and container workloads
  - Legitimate health-check wrappers in some container entrypoints
level: high
---
title: Repeated Node.js Service Crashes — Possible Exploitation Attempts
id: 5b2e9f47-6c3a-4d81-b7e9-1a4c6d8f2e05
status: experimental
description: Detects rapid restart loops or crash artifacts of Node.js services via systemd, which may indicate failed exploitation attempts against a memory-corruption bug such as the Brotli decompression RCE.
references:
  - https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/node'
      - '/nodejs'
    CommandLine|contains:
      - 'segfault'
      - 'core dumped'
      - 'SIGSEGV'
      - 'SIGABRT'
  condition: selection
falsepositives:
  - Application-level bugs in native addons (N-API modules) causing legitimate crashes
  - OOM killer terminations under memory pressure
level: medium

// Hunt: Node.js processes spawning suspicious child processes (post-exploitation after RCE)
// Works across MDE-onboarded Windows and Linux endpoints
let timeframe = 7d;
DeviceProcessEvents
| where TimeGenerated > ago(timeframe)
| where InitiatingProcessFileName =~ "node" or InitiatingProcessFileName =~ "node.exe" or InitiatingProcessFileName =~ "nodejs"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","certutil.exe",
                      "sh","bash","dash","zsh","curl","wget","nc","ncat","python","python3","perl","base64","chmod","whoami","id")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, ReportId
| sort by TimeGenerated desc;

// Hunt: Syslog evidence of node crashes/segfaults — possible exploitation attempts against Brotli decoder
Syslog
| where TimeGenerated > ago(timeframe)
| where SyslogMessage has_any ("segfault", "core dumped", "SIGSEGV", "SIGABRT")
| where SyslogMessage has_any ("node", "nodejs")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc;

// Hunt: Inventory — find hosts still running Node.js runtimes (validate patch coverage)
DeviceProcessEvents
| where TimeGenerated > ago(1d)
| where FileName in~ ("node","node.exe","nodejs")
| summarize LastSeen = max(TimeGenerated), SampleCmdLine = any(ProcessCommandLine) by DeviceName, FolderPath
| sort by DeviceName asc;

-- Hunt for Node.js processes with suspicious children or crash artifacts
-- Deploy as a Velociraptor hunt across Linux and Windows fleets

-- Part 1: Node processes and their command lines (exposure + post-exploitation triage)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)node'

-- Part 2: Suspicious shells/interpreters whose parent is a node process
SELECT child.Pid AS ChildPid, child.Name AS ChildName, child.CommandLine AS ChildCmdLine,
       parent.Pid AS ParentPid, parent.Name AS ParentName, parent.CommandLine AS ParentCmdLine,
       child.CreateTime
FROM pslist() AS child
JOIN pslist() AS parent ON child.Ppid = parent.Pid
WHERE parent.Name =~ '(?i)node'
  AND child.Name =~ '(?i)(sh|bash|dash|zsh|cmd|powershell|pwsh|curl|wget|nc|ncat|python|perl)'

-- Part 3: Recent core dumps / crash logs that may indicate exploitation attempts
SELECT FullPath, Size, Mtime
FROM glob(globs=['/var/crash/*node*', '/var/lib/apport/coredump/*', '/tmp/core*', '/var/tmp/core*'])
WHERE Mtime > (now() - 604800)

#!/usr/bin/env bash
# Security Arsenal — Node.js Brotli RCE remediation & verification script
# Run on hosts/containers to inventory Node.js runtimes and confirm patched builds.
set -euo pipefail

echo "=== Node.js Brotli RCE — Patch Verification ($(date -u)) ==="

# 1. Locate every node binary on the system (PATH, common install dirs, nvm, containers bind mounts)
echo "[1] Enumerating node binaries..."
mapfile -t NODE_BINS < <(
  { command -v node nodejs 2>/dev/null;
    ls /usr/local/bin/node /usr/bin/node /opt/*/bin/node 2>/dev/null;
    find /root/.nvm /home/*/.nvm -maxdepth 4 -name node -type f 2>/dev/null; } | sort -u
)

if [ ${#NODE_BINS[@]} -eq 0 ]; then
  echo "  No node binaries found on this host."
else
  for bin in "${NODE_BINS[@]}"; do
    ver=$("$bin" --version 2>/dev/null || echo "unknown")
    echo "  FOUND: $bin -> $ver"
  done
fi

# 2. Flag running node processes and their versions (running processes may hold OLD binary after disk patch)
echo "[2] Running node processes (must be RESTARTED after patching to load the fixed runtime):"
ps -eo pid,user,comm,args | grep -E '[n]ode' || echo "  none"

# 3. Inventory Docker images embedding a node runtime
echo "[3] Docker images containing node (rebuild after pulling updated base tags):"
if command -v docker >/dev/null 2>&1; then
  docker images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -iE '^node|node' || echo "  no node images found / docker not accessible"
else
  echo "  docker not installed"
fi

# 4. Check for applications calling Brotli decompression in deployed source (exposure triage)
echo "[4] Searching deployed code for Brotli decompression usage (attack surface):"
grep -rlE 'brotliDecompress|createBrotliDecompress|Content-Encoding.{0,20}br' \
  /srv /opt /var/www /home/*/app 2>/dev/null | head -50 || echo "  none found in scanned paths"

echo ""
echo "=== ACTION REQUIRED ==="
echo "* Upgrade every node binary above to the October 21, 2026 fixed release for its line (22.x / 24.x / 26.x)."
echo "* RESTART all node services — a patched binary on disk does not fix a running process:"
echo "    systemctl restart <your-node-service>   # or: pm2 restart all"
echo "* Rebuild containers from updated node:22 / node:24 / node:26 base images and redeploy."
echo "* Verify official fixed versions at: https://nodejs.org/en/blog/vulnerability/"