Node.js Patches Brotli Flaw That Could Allow Remote Code Execution

Node.js released security updates on October 21 for its three supported release lines, fixing 10 flaws. The most serious is an out-of-bounds write in the Brotli decompression code that Node.js bundles. The project says it could allow remote code execution, and rates it high rather than critical. The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20.x and earlier are end of life and will not get the fix, so they should be moved to a supported line.

The flaw is in bundled code, not in a business's own program. It can be triggered when an application decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server. This can happen directly through the node:zlib module or automatically when code calls fetch() on a Brotli-compressed response. Other software that bundles Brotli may also need updating, as the same fix shipped in Brotli 1.2.1, 1.1.1 and 1.0.10.

The real-world risk appears narrower than the label suggests. A public proof-of-concept published on October 22 reached code execution only against a deliberately weakened test build. On a standard build, its author reported a crash and a limited read of process memory, and said a working attack was not achieved. Patched Node.js rejects the malformed input it uses, and no exploitation in the wild had been reported as of October 22.