Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws.
The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
The Brotli flaw is in code Node.js bundles, not in a user's own program.
On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved.
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws.
An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.
Vercel , which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests.
Two are TLS certificate checks an attacker could bypass by writing a server's IP address in an unusual form, so a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483).
Node.js uses the Mozilla root certificate list but does not perform revocation checks by default, so before this update, a certificate chain built on one of the compromised keys still passed.
Node.js rates CVE-2026-105483 high, though the commit that fixed it calls the bug low-severity and hard to exploit.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line.
What happened
The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
The Brotli flaw is in code Node.js bundles, not in a user's own program.
What changed
On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved.
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws.
Who is affected
An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.
Vercel , which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests.
Why it matters
Two are TLS certificate checks an attacker could bypass by writing a server's IP address in an unusual form, so a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483).
Node.js uses the Mozilla root certificate list but does not perform revocation checks by default, so before this update, a certificate chain built on one of the compromised keys still passed.
Technical details
Node.js rates CVE-2026-105483 high, though the commit that fixed it calls the bug low-severity and hard to exploit.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line.
Patched Node.js rejects the malformed input the proof-of-concept uses, and no exploitation of the flaw in the wild has been reported as of October 22.
Response
The fix is an upstream patch from the Brotli project that Node.js copied in, and it makes the decoder catch invalid input and stop earlier rather than writing past the buffer.
Node.js 20.x and earlier have reached end of life and will not receive the fix, so they should be moved to a supported line.
What security teams should do
The same fix shipped in Brotli 1.2.1, 1.1.1, and 1.0.10 on October 21, so other software that bundles Brotli may need the same update.
The advisory offers no temporary workaround for the Brotli flaw, so an application that cannot upgrade immediately has no fallback within Node.js itself.
Attribution
The Hacker News: Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws.
What to watch next
Watch for updated vendor guidance and fixed-version details.