Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Summary: Node.js released security updates on October 21 for its 22.x, 24.x and 26.x lines, fixing 10 flaws, the most serious an out-of-bounds write in the bundled Brotli decoder that the project says can allow remote code execution. Fixed versions are 22.23.4, 24.22.1 and 26.12.1; 20.x and earlier are end of life and will not receive the fix, and the advisory offers no workaround for the Brotli flaw.
Why it matters: Node.js runs the vulnerable decoder whenever it decompresses Brotli data, including automatically on any fetch() response sent with Brotli compression, so exposure depends on whether your applications touch attacker-controlled compressed input. A public proof-of-concept on October 22 reached code execution only on a deliberately weakened test build, and no in-the-wild exploitation had been reported as of that date.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-105482CVE-2026-105483CVE-2026-106069CVE-2026-106074
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026