Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js released security updates for all three supported release lines on October 21. They fixed 10 flaws, with the most serious involving the Brotli decompression code bundled inside Node.js. The bug could allow remote code execution when malicious compressed data reaches the decoder.

The patched versions are Node.js 22.23.4, 24.22.1, and 26.12.1. Versions 22.x and 24.x are long-term support lines, while 26.x is the current line. The Brotli fix comes from an upstream patch that makes the decoder reject invalid input before it writes beyond its buffer.

Node.js 20.x and earlier are end of life and will not receive these fixes. Applications should move to a supported release line. The advisory offers no Node.js-level workaround for the Brotli flaw, so upgrading remains the direct fix.

The October 21 Node.js security updates fixed 10 flaws across the three supported release lines. The total includes the Brotli decoder vulnerability, certificate-validation problems, a DNS hostname issue, a randomness problem, and other medium- and low-severity defects.

Four flaws were rated high severity. The Brotli issue was the most serious and was described as potentially enabling remote code execution. Two high-rated issues involved bypassing TLS certificate checks by writing a server IP address in an unusual form. Another high-rated flaw prevented dns.resolve from truncating hostnames at embedded null bytes.

The article notes that Node.js rated one certificate issue high, although its fixing commit called it low-severity and difficult to exploit. The remaining six flaws were rated medium or low, including predictable values from certain crypto APIs in special application builds.

Brotli is Google’s compression library for reducing data size. Node.js bundles its own copy, so applications can use Brotli without separately installing the library. That bundled code is where the patched decoder flaw exists.

An application can invoke decompression directly through the node:zlib module. Decompression can also happen automatically when code calls fetch() and the response uses Brotli compression. In both cases, Node.js processes compressed input using its bundled Brotli decoder.

The security concern appears when that input is controlled by an attacker. Examples include a request body sent to an application or a Brotli-compressed response fetched from another server. The updates make the decoder stop earlier when input is invalid, preventing the malformed data from causing the vulnerable memory write.

The bug does not require a vulnerable application’s own business logic. Exposure depends on whether the application asks Node.js to decompress Brotli data that an attacker can influence. That makes input handling, rather than merely using Node.js, the central risk.

For example, an attacker could send a malformed Brotli-compressed request body to an application that decompresses incoming data. The same issue could arise when the application uses fetch() to retrieve a Brotli-compressed response from another server, if the attacker controls or can influence that response.

Node.js invokes its bundled decoder through node:zlib for direct decompression and through fetch() response handling for automatic decompression. The malformed input can trigger the decoder’s out-of-bounds write. Patched releases reject the proof-of-concept input, while end-of-life Node.js lines remain without the fix.

Remote code execution means an attacker may be able to run code of their choosing on the affected system. That is why the Brotli flaw is the most serious issue in the update, even though Node.js rates it high rather than critical.

The flaw is an out-of-bounds write triggered by malformed compressed input. A public proof of concept published on October 22 reached code execution only against a deliberately weakened test build. That result demonstrated the possibility under special conditions, not a normal deployment.

Against a standard Node.js build, the proof-of-concept author reported a crash and a limited read of process memory, but not code execution. The author also said a working attack on a normal build was not achieved. Patched Node.js rejects the malformed input, and no exploitation in the wild had been reported as of October 22.

A decoder turns compressed bytes into uncompressed data inside a memory buffer. Malformed input can confuse its length or position calculations, making the decoder write more bytes than the buffer can hold. The Brotli flaw is precisely this kind of out-of-bounds write.

Writing beyond the buffer can corrupt neighboring memory. If the overwritten area contains control information, such as data that influences where a program continues execution, an attacker may be able to alter the program’s behavior. In the most serious outcome, execution could be redirected to code chosen by the attacker.

The article does not show that this outcome works reliably on standard Node.js builds. The public proof of concept achieved code execution only in a deliberately weakened test build, while a standard build crashed and allowed limited memory reading. The patch makes the decoder detect invalid input and stop before the write.

Node.js does not simply call a centrally updated Brotli installation. It ships its own copy of Google’s Brotli library. That copy becomes part of Node.js releases, so fixing Brotli’s source upstream does not automatically repair already released Node.js versions.

Node.js had to copy in the upstream patch and publish new versions containing it. Other software that bundles Brotli faces the same responsibility. Its maintainers must update their embedded code, build a release, and deliver that release to users.

The same fix shipped in Brotli 1.2.1.1.1, and 1.0.10 on October 21. The article notes that the change first appeared in Brotli’s source in February 2026 but became a security release only in October. Software that bundles Brotli may therefore need its own update, even after the upstream project publishes a fix.