docs(security): add SSB-2026-007 Node2Shell bulletin

src/_posts/security/bulletins/2026-10-23-SSB-2026-007.md

@@ -0,0 +1,70 @@
+---
+title: SSB-2026-007 - Node.js Brotli decoder vulnerability (Node2Shell)
+nav: SSB-2026-007 (Node2Shell)
+modified_at: 2026-10-23 00:00:00
+tags: security bulletin scalingo nodejs brotli node2shell cve-2026-111497 remote-code-execution
+cvss:
+  version: 4.0
+  base: 9.2
+---
+
+{% note %}
+All timestamps are in CEST (UTC+2).
+{% endnote %}
+
+## TL;DR
+
+The Node.js project disclosed [CVE-2026-111497][node-advisory], an out-of-bounds write in its Brotli decoder that may allow remote code execution. Node.js rates it **High**; Google's [CVE record][cve-record] assigns it **9.2 Critical under CVSS 4.0**. Node.js 22.x, 24.x and 26.x are affected before versions **22.23.4**, **24.22.1** and **26.12.1**, respectively.
+
+**Action required:** if your application runs Node.js, check its deployed version and ensure its version constraints do not keep it on an affected release. Update any unsafe pin or constraint, rebuild and redeploy the application, then verify the version in the new deployment. Scalingo's [Node.js buildpack][buildpack-update] includes the fixed releases, but an existing application does not receive a new runtime until it is rebuilt and redeployed.
+
+## What Happened?
+
+On October 21, 2026, the Node.js project released security updates for its 22.x, 24.x and 26.x lines. Its [advisory][node-advisory] describes an out-of-bounds write in the bundled Brotli decoder. For software using Google Brotli independently of Node.js, the [CVE record][cve-record] identifies fixed Brotli releases 1.0.10, 1.1.1 and 1.2.1 for their respective release lines.
+
+The vulnerable code is reached when a Node.js process **decompresses** attacker-controlled Brotli data. Receiving an HTTP request is not enough by itself: the application or a dependency must decode its Brotli-compressed body. Outbound requests can also expose an application if it decompresses a Brotli response from an untrusted server. Serving Brotli-compressed responses to clients does not, by itself, invoke the vulnerable decoder.
+
+On October 22, [Imperva reported][imperva-research] code execution through a fetched Brotli response and configured request-body parsers in tests using the official Node.js 24.22.0 Linux arm64 image. The same inputs were rejected by 24.22.1. These results do not establish that every application using an affected Node.js version is directly reachable.
+
+## What We Did
+
+Scalingo added Node.js 22.23.4, 24.22.1 and 26.12.1 to its [Node.js buildpack inventory][buildpack-update]. The inventory update does not change the runtime in an application that is already deployed. Confirm the version selected by your next build and running in the redeployed application.
+
+## What We Will Do
+
+Starting 23 October 2026 at 15:00 CEST, Scalingo will reject incoming requests with the `Content-Encoding: br` header. If your clients send Brotli-compressed request bodies, change them to send uncompressed bodies without that header before this time. This measure covers incoming requests only; you still need to update Node.js to address Brotli responses fetched by your application.
+
+If you need the filtering rule disabled, contact [Scalingo support](mailto:support@scalingo.com). Disabling it can restore the inbound exposure for applications that decode Brotli request bodies on an affected Node.js version.
+
+## What You Should Do
+
+1. Check the Node.js version in your deployed application, for example with `scalingo --app my-app run node --version` in a [one-off container]({% post_url platform/app/2000-01-01-tasks %}).
+2. Check the `engines.node` constraint in `package.json` and any custom buildpack or runtime pin. If it pins an affected release or excludes the fix, change it so the next build selects at least **22.23.4** on 22.x, **24.22.1** on 24.x, or **26.12.1** on 26.x. For example, an exact `24.22.0` pin must be updated. See [Node.js version selection]({% post_url languages/nodejs/2000-01-01-start %}#select-a-version).
+3. Rebuild and redeploy the application using your usual [Git deployment]({% post_url platform/deployment/2000-01-01-deploy-with-git %}) or [GitHub deployment]({% post_url platform/deployment/2000-01-01-deploy-with-github %}#deployments) process. Restarting the existing deployment does not replace its Node.js runtime.
+4. Run `node --version` in a new one-off container after the deployment and confirm that the fixed version is running. If the version did not change, review the build log and version constraints before treating the application as updated.
+
+Prioritize applications that decode Brotli request bodies or fetch and decompress responses from servers they do not control. This includes applications whose frameworks or HTTP clients perform decompression on their behalf. Updating the runtime addresses both paths.
+
+If you use a custom container image or supply your own Node.js runtime, update that runtime in the image, rebuild and redeploy it, and check `node --version` in the running image. For an end-of-life Node.js line, move to a supported, fixed line; the [Node.js security release][node-advisory] provides fixes for 22.x, 24.x and 26.x.
+
+## Product Impacts
+
+### Scalingo PaaS
+
+Applications running an affected Node.js version may be exposed if they decompress attacker-controlled Brotli data. The buildpack update does not change existing deployments; check the runtime version in each application after redeployment.
+
+## Contact
+
+If you need help checking or updating an application, contact Scalingo support at [support@scalingo.com](mailto:support@scalingo.com) or through the in-dashboard chat.
+
+## Timeline
+
+| Date and time | Milestone |
+| --- | --- |
+| <span style="white-space:nowrap">2026-10-21 12:38</span> | Node.js publishes fixed releases 22.23.4, 24.22.1 and 26.12.1. |
+| <span style="white-space:nowrap">2026-10-21 15:31</span> | Scalingo merges the Node.js buildpack inventory update containing these releases. |
+
+[node-advisory]: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
+[cve-record]: https://www.cve.org/CVERecord?id=CVE-2026-111497
+[imperva-research]: https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
+[buildpack-update]: https://github.com/Scalingo/nodejs-buildpack/pull/286