Node.js has rolled out urgent security patches to address ten vulnerabilities across its three active release lines—22.x, 24.x, and 26.x. The most severe issue involves the Brotli decompression code bundled with Node.js, which might allow remote actors to execute arbitrary code when processing maliciously crafted compressed data. All three supported branches have received updates as of October 21.
The Dangerous Bug in Brotli Decoder
The key flaw is an out-of-bounds write in the built-in Brotli decoder. Malformed compressed input—sent through APIs like node:zlib or via fetch() when dealing with Brotli-compressed responses—can trigger it. During decompression, Node.js could write past the end of its internal buffer. The patch tightens input validation so invalid input triggers an early stop instead of buffer overruns.
This vulnerability affects the current Node.js releases 22.x, 24.x, and 26.x—older 20.x and earlier versions are no longer supported and thus won’t receive fixes. Specifically, the patched versions are 22.23.4, 24.22.1, and 26.12.1. Users on end-of-life lines are urged to upgrade immediately.
A public proof-of-concept released on October 22 shows remote code execution only under a deliberately weakened test build. On standard builds, it caused crashes and limited memory readouts, but no confirmed arbitrary code execution. So far, no real-world attacks tied to this flaw have been observed.
Other High and Moderate Flaws in the Release
Besides the Brotli issue (now tracked as CVE-2026-111497), four other high-severity flaws were squashed. Two involve bypasses of TLS hostname checks via non-canonical IP address formats; another deals with hostnames cut short by null bytes inside dns.resolve; the fourth is also a TLS certificate validation weakness. These issues affect all supported Node.js lines.
Medium-level risks include a flaw where crypto.randomUUID() and crypto.randomInt() return predictable values when using startup snapshots or single-executable builds. Lower-severity defects cover issues like ZIP file parsing, permission model bypasses using wildcard lookups, and fs.realpathSync behavior. Fixes have been applied to bundled components too: undici (HTTP client behind fetch), c-ares, OpenSSL, and SQLite, among others.
Compromised Certificates from eMudhra Blocked
In addition to the code bugs, the updates respond to a certificate authority compromise involving eMudhra. Eight intermediate CA keys identified as compromised are now explicitly blocked, and a few emSign root certificates were removed from the bundled root store. Previously trusted certificate chains built on these keys would pass validation unless revoked—a shortcoming now corrected. End-of-life versions will not receive these blocks.
What You Should Do Right Now
The only reliable mitigation is upgrading Node.js to the fixed versions: 22.23.4, 24.22.1, or 26.12.1. No temporary workaround exists within Node.js for the Brotli vulnerability. Hosting platforms like Vercel have deployed firewall rules to filter certain inbound malformed requests, but these don’t protect against malicious Brotli responses fetched from other servers. They’re partial shields—not substitutes for upgrading.
This security bundle is one of the most critical Node.js users face in recent times. Brotli compression is widely used for HTTP content delivery, especially in web fetching and server-side APIs. An attacker who can craft or influence compressed data—either via upload or by manipulating external HTTP responses—could exploit this to escape containment or run arbitrary code.
Monitoring dependency patch releases matters more than ever. Many developers assume bundled libraries don’t carry critical risk—but whenever secondary components like Brotli, undici, OpenSSL, or even CA stores are updated, they should be reviewed immediately. Watch for equivalent fixes in other software that ships Brotli, since they are likely affected. If you manage infrastructure that runs Node.js—especially production servers or edge-facing services—this is not something to delay.
Why This Matters
Brotli compression is now a backbone technology in web performance, from content delivery networks to APIs responding with compressed payloads. When flaws lurk inside such components, nearly every layer of a tech stack becomes exposed. For Node.js, which already integrates Brotli deeply, the risk of remote code execution elevates this issue into a clear and present danger.
