Node.js Brotli

Your Node.js server might be running code that can be crashed or compromised by a malformed request, because the project just released security updates fixing 10 flaws, and the most serious one is a bug in the bundled Brotli decompression code that the project says can allow remote code execution, which means an attacker could theoretically run their own code on your system.

The updates landed on October 21 for the three supported release lines: 22.x, 24.x, and 26.x.

If you are running Node.js 20.x or earlier, you are out of luck. Those lines have reached end of life and will not receive the fix.

What Makes the Node.js Brotli Flaw So Serious

The flaw lives in the Brotli code that Node.js bundles, not in your own program.

Node.js runs that code whenever it decompresses Brotli data. That happens either directly through the node:zlib module or automatically when your code calls fetch() on a response sent with Brotli compression.

An application is exposed wherever it decompresses Brotli data an attacker controls. That could be a request body or a response fetched from another server.

The bug is an out-of-bounds write in the Brotli decoder, triggered by malformed compressed input. The fix is an upstream patch from the Brotli project that Node.js copied in, which makes the decoder catch invalid input and stop earlier rather than writing past the buffer.

Brotli is Google's compression library. The same fix shipped in Brotli 1.2.1, 1.1.1, and 1.0.10 on October 21, so other software that bundles Brotli may need the same update.

The Reality of the Remote Code Execution Claim

Node.js describes the flaw as allowing remote code execution, and rates it high rather than critical. How far that has been shown in practice is narrower.

A public proof-of-concept published on October 22 reached code execution only against a deliberately weakened test build.

On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution. The author said a working attack on a normal build was not achieved.

Patched Node.js rejects the malformed input the proof-of-concept uses. No exploitation of the flaw in the wild has been reported as of October 22.

That is a lucky break, but it is not a reason to delay patching. A crash and memory leak are still serious.

The Other High-Severity Flaws in This Update

Three of the other fixes are also rated high.

Two are TLS certificate checks an attacker could bypass by writing a server's IP address in an unusual form, allowing a certificate to match a host it should not. Those are CVE-2026-106069 and CVE-2026-105483.

The third stops dns.resolve from cutting a hostname short at an embedded null byte (CVE-2026-105482).

Node.js rates CVE-2026-105483 high, though the commit that fixed it calls the bug low-severity and hard to exploit.

Medium and Low Severity Fixes Worth Noting

The rest are medium and low severity, but one stands out for anyone building single-executable applications.

CVE-2026-106074 makes crypto.randomUUID() and crypto.randomInt() hand back the same values in every process when an app is built as a startup snapshot or a single-executable application. That undermines anything relying on those values being unpredictable.

Here is the full list of what was fixed:

The eMudhra Certificate Block

The same updates also stop Node.js from trusting eight intermediate certificate authority keys from the Indian provider eMudhra that were reported compromised days earlier.

Node.js uses the Mozilla root certificate list but does not perform revocation checks by default. Before this update, a certificate chain built on one of the compromised keys still passed.

The releases add a built-in block on the eight keys and update the bundled root list to remove three emSign roots. Go made the same block in its own update on October 20.

Connections resumed from a session that began before the update are not re-checked until that session times out. End-of-life lines do not get the block at all.

What to Upgrade to Right Now

Each supported line has one fixed version. If you are on an older branch, move to a supported line immediately.

Beyond the 10 flaws, the updates refresh several bundled parts. The copy of undici moves to a version that fixes three moderate advisories: one in its Subresource Integrity check and two memory-exhaustion flaws, one of them in the built-in WebSocket client.

Node.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x.

Why You Can't Just Wait for a Workaround

Upgrading is the fix. The advisory offers no temporary workaround for the Brotli flaw, so an application that cannot upgrade immediately has no fallback within Node.js itself.

Vercel, which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests. The rules do not cover Brotli responses an application fetches from other servers, and they do not replace upgrading.

If you fetch data from third-party APIs, a firewall rule on your inbound traffic will not save you. You have to patch the runtime.

FAQ

What is the Node.js Brotli vulnerability?

It is an out-of-bounds write in the Brotli decoder bundled with Node.js, tracked as CVE-2026-111497. It can be triggered by malformed compressed input and is rated high severity.

Which Node.js versions fix the flaw?

Node.js 22.23.4, 24.22.1, and 26.12.1. Node.js 20.x and earlier are end of life and will not receive the fix.

Does this flaw allow remote code execution?

Node.js describes it as allowing remote code execution, but a public proof-of-concept only achieved that on a deliberately weakened test build. On standard builds, it caused a crash and limited memory read.

Is there a workaround if I can't upgrade immediately?

No. The advisory offers no temporary workaround for the Brotli flaw. Vercel added firewall rules for inbound requests, but those do not protect against Brotli data fetched from other servers.

What is the eMudhra certificate block?

Node.js added a block on eight compromised intermediate certificate keys from eMudhra and removed three emSign roots from its bundled list. Without the block, certificate chains built on those keys still passed because Node.js does not perform revocation checks by default.

Source: The Hacker News