Update Node.js to 22.23.4, 24.22.1 or 26.12.1 to Patch High-Severity Brotli Flaw

Node.js published security updates on October 21 for its active release branches. These patches address ten vulnerabilities, including a high-severity bug in the Brotli decompression code that ships with the runtime. The project states this flaw could enable remote code execution, allowing an attacker to run arbitrary instructions on the host system.

The risk

The vulnerability stems from an out-of-bounds write in the Brotli decoder. This error is triggered when the decoder processes malformed compressed input. Instead of rejecting the invalid data, the original code wrote past the buffer boundary. The fix, adopted from an upstream Brotli project patch, ensures the decoder stops processing when it encounters invalid input.

Node.js executes this bundled code whenever it decompresses Brotli data. This occurs directly through the node:zlib module or automatically when code uses fetch() to retrieve a response sent with Brotli compression. An application becomes exposed if it decompresses any Brotli data that an attacker can control, such as a request body or a response from a remote server.

Who is exposed

Only the three currently supported Node.js lines are affected by this specific update cycle. Developers using version 20.x or earlier have reached end of life and will not receive this fix. These older versions should be migrated to a supported line to obtain the security patch.

The fixed versions are 22.23.4 for the long-term support branch, 24.22.1 for the second long-term support branch, and 26.12.1 for the current release line. Other software that bundles its own copy of the Brotli library may also need to update to versions 1.2.1, 1.1.1, or 1.0.10, which received the same upstream fix on October 21.

Cost and compliance

The project rates this flaw as high rather than critical. This distinction reflects the practical difficulty of exploitation. A public proof-of-concept published on October 22 achieved code execution only against a deliberately weakened test build of Node.js. On a standard build, the same input caused a crash and a limited read of process memory, but did not result in code execution.

The author of the proof-of-concept stated that a working attack on a normal build had not been achieved. Patched Node.js versions reject the malformed input used in the demonstration. As of October 22, no exploitation of this flaw in the wild has been reported.

Our take on the response

That suggests the immediate risk of widespread automated attacks is low, but the potential impact remains severe. Teams should prioritize patching because the attack surface includes common web interactions like fetching external data.

What defenders should look for

Security teams should monitor application logs for unexpected crashes or segmentation faults during data processing, which may indicate an attempt to trigger the buffer overflow. Check network traffic for unusually large or malformed compressed payloads sent to endpoints that handle user input. If an anomaly is detected, isolate the affected service immediately to prevent further interaction with potentially malicious data streams. Review access controls to ensure that only trusted sources can submit compressed data to internal decompression routines.

What to do and how to stay safe: Node.js

• Upgrade Node.js installations to 22.23.4, 24.22.1, or 26.12.1 as soon as possible.
• Migrate any infrastructure running Node.js 20.x or earlier to a supported version.
• Identify applications that decompress user-supplied data or fetch external resources via Brotli.
• Monitor system logs for crashes or unusual memory access patterns after exposure to untrusted input.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability affect Node.js 20.x?

No, Node.js 20.x has reached end of life and will not receive this fix.

Has this flaw been exploited in the wild?

No, no exploitation of the flaw in the wild has been reported as of October 22.

What is the severity of this vulnerability?

The project rates the flaw as high rather than critical.