cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Node.js Updates Fix Brotli Decoder Flaw That Could Enable Remote Code Execution

· Original article ↗

Summary

Node.js fixed 10 flaws across supported release lines, including a Brotli decoder out-of-bounds write. A public proof of concept achieved code execution only on a deliberately weakened build; no in-the-wild exploitation was reported.

Key points

  • Node.js released fixes in versions 22.23.4, 24.22.1, and 26.12.1. Versions 20.x and earlier are end of life and will not receive these fixes.
  • The Brotli decoder flaw is an out-of-bounds write triggered by malformed compressed input. Applications are exposed when they decompress attacker-controlled Brotli data, including through node:zlib or fetch().
  • The Node.js project says the flaw could allow remote code execution. A public proof of concept published October 22 achieved code execution only on a deliberately weakened test build; on a standard build, its author reported a crash and limited memory read.
  • The updates reject the malformed input used by the proof of concept. No exploitation in the wild had been reported as of October 22.
  • Three other high-severity fixes address TLS certificate checks and dns.resolve hostname truncation; a medium-severity fix addresses repeated crypto.randomUUID() and crypto.randomInt() values in snapshot or single-executable applications.
  • The releases block eight intermediate certificate authority keys reported compromised from eMudhra and remove three emSign roots. Existing connections are not rechecked until their sessions time out, and end-of-life Node.js lines do not get the block.
  • Upgrading is the recommended fix; Node.js offers no temporary workaround for the Brotli flaw. Vercel added inbound-request firewall rules, but they do not cover Brotli responses fetched from other servers or replace upgrading.

Article Details

Vulnerability Types
  • Out-of-bounds write in the Brotli decoder triggered by malformed compressed input
  • TLS certificate validation bypass involving unusually formatted server IP addresses
  • Hostname truncation at an embedded null byte in dns.resolve
  • Repeated crypto.randomUUID() and crypto.randomInt() values in startup-snapshot or single-executable applications
Severity
High for the Brotli flaw; three other fixes are rated high, with remaining fixes rated medium or low.
Affected Versions
  • Node.js 22.x
  • Node.js 24.x
  • Node.js 26.x
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available

CVE

CVE-2026-105482The third stops dns.resolve from cutting a hostname short at an embedded null byte (CVE-2026-105482).CVE-2026-105483IP address in an unusual form, so a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483). The third stops dns.resolve from cutting a hostname short at an embedded null byteCVE-2026-106069by writing a server's IP address in an unusual form, so a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483). The third stops dns.resolve from cutting a hostname short at an embedded nullCVE-2026-106074every process when an application is built as a startup snapshot or a single-executable application (CVE-2026-106074), which undermines anything that relies on those values being unpredictable.

Vendors

VercelVercel, which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests. The rules do not cover Brotli responses an application fetches from other servers, and

Products

Brotliits three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaningc-aresNode.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x, to include fixes for publicly known vulnerabilities.Node.jsNode.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which theOpenSSLNode.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x, to include fixes for publicly known vulnerabilities.SQLiteNode.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x, to include fixes for publicly known vulnerabilities.undiciBeyond the 10 flaws, the updates refresh several bundled parts. The copy of undici, the HTTP client behind fetch(), moves to a version that fixes three moderate advisories: one in its Subresource Integrity check and two

Related Articles