Node.js patches Brotli decoder flaw it says could allow remote code execution

Past-week coverage · Original source published 2026-10-22.

Node.js published security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, addressing 10 flaws in total. The project describes the most serious as a bug in the Brotli decompression code that Node.js bundles, which it says can allow remote code execution, meaning an attacker could run code of their choosing on an affected system.

Each supported line received one fixed version, according to the release notes summarized by The Hacker News. The report does not detail the remaining nine flaws, the conditions an attacker would need to reach the Brotli bug, or whether exploitation has been observed.

Why it matters

Brotli is a compression format that Node.js ships inside its runtime rather than leaving to a separate dependency. That puts the decoder in the path of any application that handles compressed input, so a memory-safety problem there can matter well beyond the project itself. The project's own description of the impact is the strongest signal in the source: it characterizes the bug as remote code execution rather than a crash or denial of service.

What defenders should do

• Identify which Node.js release line each service runs and move to the fixed version the project published for that line.
• Check whether applications accept compressed request bodies or other Brotli-encoded input from untrusted sources, since that is where a decoder flaw would be reachable.
• Track the project's security advisories for the technical detail the summary here does not cover.

The source gives no severity score, no affected version range beyond the three release lines, and no indication of in-the-wild exploitation. Treat the absence of those details as a gap to fill from the project's own advisory, not as reassurance.