Node.js released security patches on October 21 addressing 10 vulnerabilities across its three supported release lines, with the most severe being a Brotli decompression bug that could enable remote code execution. The flaw, which affects versions 22.x, 24.x, and 26.x, allows an attacker to potentially run arbitrary code on affected systems by exploiting how Node.js handles compressed data. The project shipped fixed versions 22.23.4, 24.22.1, and 26.12.1, while earlier versions that have reached end of life won't receive the update.
The Brotli vulnerability is an out-of-bounds write triggered by malformed compressed input in code Node.js bundles rather than in user-written programs. Applications become vulnerable when they decompress Brotli data controlled by attackers, such as request bodies or responses fetched from external servers. The flaw surfaces whenever Node.js decompresses Brotli data, either through direct use of the node:zlib module or automatically when code calls fetch() on responses sent with Brotli compression. Beyond the headline flaw, three other high-severity issues were patched: two TLS certificate check bypasses that let attackers write server IP addresses in unusual forms so certificates match hosts they shouldn't, and a dns.resolve bug that cuts hostnames short at embedded null bytes. A medium-severity flaw also broke crypto.randomUUID() and crypto.randomInt() in startup snapshots and single-executable applications, making them return identical values in every process instead of unpredictable ones.
According to The Hacker News report, Node.js describes the Brotli issue as enabling "remote code execution" and rates it high rather than critical severity. The fix applies an upstream patch from Google's Brotli project that makes the decoder catch invalid input and halt before writing past the buffer, copied from Brotli versions 1.2.1, 1.1.1, and 1.0.10 released the same day. A proof-of-concept published October 22 achieved code execution only against a deliberately weakened test build; on standard Node.js builds, its author reported only a crash and limited process memory read, "not code execution," and confirmed a working attack on normal builds "was not achieved." The patched Node.js versions reject the malformed input used in the proof-of-concept, and no wild exploitation had been reported as of October 22.
The updates also block eight compromised intermediate certificate authority keys from Indian provider eMudhra that were reported compromised days before, since Node.js uses Mozilla's root certificate list but doesn't perform revocation checks by default. The releases add a built-in block on those eight keys and update the bundled root list to remove three emSign roots, matching a similar block Google's Go made in its October 20 update. Node.js also refreshed several bundled components including undici (the HTTP client behind fetch()) to fix three moderate advisories covering a Subresource Integrity check issue and two memory-exhaustion flaws. The advisory offers no temporary workaround for the Brotli flaw, leaving applications unable to upgrade immediately without a fallback within Node.js itself, though Vercel said it added firewall rules October 21 to block the attack in inbound requests—rules that don't cover Brotli responses fetched from other servers and don't replace upgrading. Organizations running Node.js 20.x or earlier face particular urgency since those end-of-life versions will never receive these fixes and must migrate to supported lines. The breadth of affected components and absence of in-the-wild exploits create a window for orderly patching, but the remote code execution potential means delay carries real infrastructure risk.