Merge pull request #169 from meshtastic/fix/node2shell-brotli

Stop the Connect endpoint decoding Brotli request bodies (CVE-2026-111497)

Author: thebentern

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
           # buffer.SlowBuffer is gone and the octokit -> jwa import chain throws on load, so the
           # server could not boot at all on the version CI was testing -- while the version we
           # actually ship was never exercised.
-          node-version: "22"
+          node-version-file: .nvmrc
 
       - name: Install Dependencies
         run: pnpm install --ignore-scripts=false
@@ -65,7 +65,7 @@ jobs:
           # buffer.SlowBuffer is gone and the octokit -> jwa import chain throws on load, so the
           # server could not boot at all on the version CI was testing -- while the version we
           # actually ship was never exercised.
-          node-version: "22"
+          node-version-file: .nvmrc
 
       - name: Install Dependencies
         run: pnpm install --ignore-scripts=false

.github/workflows/sync-maintenance-uf2.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version-file: .nvmrc
 
       - name: Install dependencies
         run: pnpm install --ignore-scripts=false

.nvmrc

@@ -1 +1 @@
-22
+22.23.4

package.json

@@ -28,6 +28,7 @@
     "@bufbuild/protobuf": "^1.7.2",
     "@connectrpc/connect": "^1.3.0",
     "@connectrpc/connect-express": "^1.3.0",
+    "@connectrpc/connect-node": "^1.3.0",
     "@meshtastic/js": "2.2.23-0",
     "@octokit/auth-app": "^6.0.3",
     "@prisma/client": "5.22.0",

pnpm-lock.yaml

@@ -1,5 +1,6 @@
 import { GatewayService } from "@buf/meshtastic_api.connectrpc_es/protobufs/gateway/v1/gateway_service_connect.js";
 import { expressConnectMiddleware } from "@connectrpc/connect-express";
+import { compressionGzip } from "@connectrpc/connect-node";
 import { App } from "@tinyhttp/app";
 import { cors } from "@tinyhttp/cors";
 import { config } from "@tinyhttp/dotenv";
@@ -84,6 +85,10 @@ app
         router.service(GatewayService, new Gateway());
       },
       connect: true,
+      // gzip only. Left unset, this also accepts br on all three protocols, which hands any
+      // client's request bytes to Node's bundled Brotli decoder -- the decoder CVE-2026-111497
+      // (Node2Shell) writes out of bounds in. Nothing calls this service with compressed requests.
+      acceptCompression: [compressionGzip],
       // @ts-expect-error
     })(req, res, next);
   });