Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix, so they should be moved to a supported line.
The Brotli flaw is in code Node.js bundles, not in a user's own program. Node.js runs that code whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression.
An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.
The flaw is an out-of-bounds write in the Brotli decoder, set off by malformed compressed input. The fix is an upstream patch from the Brotli project that Node.js copied in, and it makes the decoder catch invalid input and stop earlier rather than writing past the buffer.
js ships its own copy. 10 on October 21, so other software that bundles Brotli may need the same update. The change was first made in Brotli's source in February 2026 and shipped as a security release only in October.
Source link
