Node.js Brotli Decoder Flaw Threatens Remote Code Execution Across All Supported Versions

The Node.js project released security updates on October 21, 2026, for all three supported release lines — 22.x, 24.x and 26.x — fixing 10 flaws. The patched builds are 22.23.4 and 24.22.1 on the long-term support lines and 26.12.1 on the current one. The 20.x line and earlier have reached end of life and will not get the fix, so users are urged to move to a supported line.

The Brotli bug

The headline flaw (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder — Google's compression library, a copy of which Node.js bundles. It is triggered by malformed compressed input. Node.js runs that code whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when an application calls fetch() on a response sent with Brotli compression. Applications are exposed wherever they decompress attacker-controlled data, such as a request body or a response fetched from another server.

The fix is an upstream patch from the Brotli project; the same code shipped in Brotli 1.2.1, 1.1.1 and 1.0.10, so other software that bundles the library may need the update too. Curiously, the change landed in Brotli's source back in February 2026 but was only released as a security fix in October.

The flaw is rated high rather than critical, and in practice its reach is narrower than the "remote code execution" label suggests. A public proof-of-concept released on October 22 reached code execution only against a deliberately weakened test build; on a standard build its author reported a crash and a limited read of process memory, not code execution. Patched Node.js rejects the malformed input, and no exploitation in the wild had been reported as of October 22.

The other fixes

Three more flaws are also rated high: two TLS hostname-check bypasses triggered by writing a server's IP address in a non-canonical form (CVE-2026-106069 and CVE-2026-105483), and a bug where dns.resolve truncated a name at an embedded null byte (CVE-2026-105482). Among the medium issues, crypto.randomUUID() and crypto.randomInt() returned the same values in every process when an app is built as a startup snapshot or a single-executable application (CVE-2026-106074), undermining anything that relies on those values being unpredictable.

The eMudhra certificate block

The same updates also stop Node.js from trusting eight intermediate CA keys from the Indian provider eMudhra, reported compromised days earlier. Node.js uses the Mozilla root list but does not check revocation by default, so before this update a chain built on one of the compromised keys still passed. Go made the same block in its own October 20 update.

The releases also refresh bundled components: undici (the HTTP client behind fetch()), c-ares, OpenSSL and SQLite. There is no temporary workaround for the Brotli flaw — upgrading is the only remedy. Vercel said it added firewall rules on October 21 that block the attack in inbound requests, but they do not cover Brotli responses an app fetches from other servers.

Source: The Hacker News