Node.js patches remote code execution flaw in bundled Brotli decoder

Node.js released critical security updates on October 21 for its three supported release lines: 22.x, 24.x, and 26.x. The most significant fix addresses a vulnerability in the bundled Brotli decompression library that could potentially allow attackers to execute arbitrary code on affected systems. Developers running end-of-life versions like Node.js 20.x must upgrade immediately, as these older lines will not receive patches.

What happened

The Node.js project fixed ten distinct flaws in this release cycle, but the primary concern is CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder. This bug exists in the copy of Google’s Brotli library that Node.js ships internally, meaning it affects any application that decompresses Brotli data, whether through the node:zlib module or automatically via fetch() responses. The vulnerability is triggered by malformed compressed input, which causes the decoder to write data beyond the allocated memory buffer.

While the project rates this flaw as high severity with potential for remote code execution (RCE), practical exploitation appears difficult. A public proof-of-concept published on October 22 demonstrated code execution only on a deliberately weakened test build. On standard builds, the exploit caused a crash and limited memory read rather than full code execution. As of October 22, no active exploitation in the wild has been reported, and patched versions now reject the malformed input used in these tests.

In addition to the Brotli issue, the update addresses three other high-severity vulnerabilities. Two involve TLS certificate checks that attackers could bypass by using non-canonical IP address forms or fullwidth digits, allowing certificates to match hosts they should not. The third high-severity fix prevents dns.resolve from truncating hostnames containing embedded null bytes. The remaining fixes cover medium and low-severity issues, including problems with random number generation in startup snapshots and permission model bypasses.

How it works

Brotli is a compression algorithm developed by Google, widely used for web content because it offers better compression ratios than gzip. Node.js bundles its own copy of the Brotli source code rather than relying on a system-level library. When an application receives compressed data, the internal decoder processes the bitstream to reconstruct the original content. The vulnerability arose because the decoder did not properly validate certain edge cases in malformed input, leading to an out-of-bounds write. This means the program wrote data to a memory location it was not authorized to access, which can corrupt memory or allow an attacker to inject and run malicious code.

The fix involves an upstream patch from the Brotli project, which Node.js incorporated into its codebase. This patch adds stricter validation checks that cause the decoder to fail early and safely when it encounters invalid input, preventing the memory corruption. Because many other software projects also bundle their own copies of Brotli, similar updates are likely required across the broader ecosystem. The same fix was released in Brotli versions 1.2.1, 1.1.1, and 1.0.10 on October 21.

Key details

• Fixed versions: Node.js 22.23.4, 24.22.1, and 26.12.1 contain the necessary patches.
• End-of-life warning: Node.js 20.x and earlier are unsupported and will not receive this fix; migration is required.
• Attack vector: Applications are exposed if they decompress Brotli data from untrusted sources, such as request bodies or external API responses.
• Certificate block: The update also blocks eight compromised intermediate certificate authority keys from eMudhra and removes three emSign roots.
• Dependency updates: Bundled versions of undici, c-ares, OpenSSL (on 22.x and 24.x), and SQLite (on 22.x) were updated to fix additional known vulnerabilities.
• No workaround: There is no temporary mitigation within Node.js for the Brotli flaw; upgrading is the only solution.

Why it matters

For backend engineers and technical leads, this update highlights the risks inherent in bundling third-party libraries. Even though the code was not written by the Node.js team, the responsibility for securing it falls on the runtime maintainers and, ultimately, the developers who deploy it. The fact that the vulnerability exists in automatic processes like fetch() means that even applications not explicitly using compression libraries may be at risk if they interact with external services that return Brotli-compressed data.

The inclusion of the eMudhra certificate block also underscores the importance of trust stores in secure communications. Since Node.js does not perform revocation checks by default, compromised certificate authority keys can remain trusted until explicitly blocked. This release serves as a reminder that security is not just about fixing code bugs but also about maintaining the integrity of the cryptographic infrastructure that underpins secure connections.

What you can do

• Upgrade immediately to Node.js 22.23.4, 24.22.1, or 26.12.1 depending on your current release line.
• Migrate any applications still running on Node.js 20.x or earlier to a supported version.
• Review any custom deployments or single-executable applications to ensure they are rebuilt with the patched versions.
• Monitor logs for unusual crashes or memory errors that might indicate attempted exploitation before the patch was applied.
• Verify that your CI/CD pipelines are configured to pull the latest patched base images for containerized deployments.
• If immediate upgrading is impossible, consider implementing network-level firewall rules to block suspicious inbound requests, though this does not protect against outbound fetch vulnerabilities.