Node.js has rolled out crucial security patches as of October 21, targeting its three active release lines: 22.x, 24.x, and 26.x. Notably, these updates remedy a severe bug within the Brotli decompression code, which could potentially allow remote code execution. This vulnerability enables attackers to execute arbitrary code on compromised systems.
Details of the Brotli Vulnerability
The vulnerability stems from an out-of-bounds write error in the Brotli decoder, triggered by malformed compressed input. Node.js bundles this code, which activates during Brotli data decompression via the node:zlib module or when a fetch() request involves Brotli-compressed responses. The flaw could expose applications when an attacker manipulates the Brotli data, such as request bodies or responses from external servers.
The fix applies an upstream patch from the Brotli project, preventing improper data handling by rejecting invalid input early in the process. Although Node.js describes the flaw as allowing remote code execution, its practical impact is more limited. A public proof-of-concept, released on October 22, could only achieve code execution in a deliberately weakened test scenario, with standard builds resulting in crashes or limited memory access.
Other Security Concerns and Fixes
Alongside the Brotli flaw, Node.js addressed three other high-severity issues. Two relate to TLS certificate checks, where attackers could exploit atypical IP address formats to bypass hostname verification (CVE-2026-106069, CVE-2026-105483). Another flaw, CVE-2026-105482, involves the dns.resolve function truncating hostnames at null bytes.
Medium and low-severity issues were also patched, including problems with crypto.randomUUID() and crypto.randomInt() functions in specific application builds (CVE-2026-106074), as well as vulnerabilities in the Permission Model and ZipFile handling.
Additional Security Measures
The updates also revoke trust in eight compromised intermediate certificate authority keys from eMudhra, following recent reports of key compromises. Node.js incorporates Mozilla’s root certificate list but lacked default revocation checks before these updates, allowing potentially compromised chains to pass validation.
Beyond addressing these vulnerabilities, Node.js updated several dependencies, including undici, OpenSSL, SQLite, and c-ares, to fix additional known security issues.
For systems unable to upgrade immediately, interim solutions are limited. Vercel, a Node.js service provider, has implemented firewall rules to mitigate attacks through inbound requests since October 21, although these do not cover Brotli responses fetched from other servers. Upgrading remains the recommended course of action to protect systems fully.
