<![CDATA[Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions]]>Node.js has pushed security updates for all three of its supported release lines — 22.x, 24.x, and 26.x — addressing a total of 10 flaws. The standout issue is a vulnerability in the Brotli decompression code bundled with Node.js, which the project states could enable remote code execution, potentially letting an attacker run arbitrary code on an affected system.

Each supported release line has a single fixed version available, so administrators should confirm they are running the corrected build for their branch and treat the Brotli issue as the priority item when planning patching.

  • 22.x — apply the latest fixed release for this line
  • 24.x — apply the latest fixed release for this line
  • 26.x — apply the latest fixed release for this line

The remaining nine fixes in the same batch should be reviewed alongside the Brotli patch, as they ship together in the October 21 updates. Given that the flaw lives in decompression code, any service that processes Brotli-compressed input from untrusted sources deserves immediate attention.

Source: The Hacker News

Are you running any of the affected release lines in production, and have you scheduled the upgrade yet?

]]>https://xploitlk.com/topic/787/node.js-brotli-decoder-bug-could-allow-remote-code-execution-in-all-supported-versionsRSS for NodeTue, 27 Oct 2026 07:22:49 GMTSun, 25 Oct 2026 12:30:16 GMT60