Node.js Brotli Decompression Bug Enables Remote Code Execution Risks

Node.js distributed security updates for its three active release lines on October 21, addressing ten distinct vulnerabilities. The most significant issue resides in the bundled Brotli decompression library, which the project states could permit remote code execution by allowing attackers to run arbitrary commands on affected systems.

What happened

The vulnerability stems from an out-of-bounds write error within the Brotli decoder code that Node.js includes natively. This flaw activates when the system processes malformed compressed input, potentially overwriting memory beyond the intended buffer boundaries. The underlying fix originated from the Brotli project itself and was incorporated into Node.js to ensure the decoder halts processing upon detecting invalid data.

Node.js executes this decompression code automatically when applications use the node:zlib module or when the fetch() API retrieves responses compressed with Brotli. Consequently, any application that decompresses data controlled by an attacker, such as request bodies or responses from external servers, remains exposed to this risk. The flaw exists in the runtime itself, not in user-written application logic.

Fixed versions include 22.23.4 and 24.22.1 for the long-term support lines, alongside 26.12.1 for the current release line. Versions prior to 22.x, including the 20.x line, have reached end of life and will not receive this patch. Users on those older lines must migrate to a supported version to obtain protection.

Why it matters

The project rates the Brotli flaw as high severity rather than critical, noting that practical exploitation remains limited. A public proof-of-concept released on October 22 successfully achieved code execution only against a deliberately weakened test build. On standard Node.js builds, the same proof-of-concept caused crashes and limited memory reads but did not achieve full code execution.

As of October 22, no wild exploitation of this specific vulnerability has been reported. The patched Node.js versions now reject the malformed input used in the proof-of-concept. Additionally, three other high-severity fixes address TLS certificate checks that attackers could bypass by using unusual IP address formats, identified as CVE-2026-106069 and CVE-2026-105483.

What to watch

• Verify that all Node.js instances are running versions 22.23.4, 24.22.1, or 26.12.1.
• Identify applications that decompress Brotli data from untrusted network sources.
• Monitor for crashes or unusual memory access patterns in Node.js processes.
• Check for other software bundling Brotli that may require separate updates.

Signals worth monitoring

Security teams typically observe unexpected process terminations or segmentation faults when memory corruption occurs. Alerts for anomalous outbound connections from application servers may indicate post-exploitation activity. Teams usually review system logs for repeated decompression errors or abnormal CPU spikes during data ingestion. Checking whether network traffic includes malformed compressed payloads helps identify targeted assets. Initial containment often involves isolating affected nodes from the network to prevent lateral movement while verifying the integrity of running processes and memory states.

Background: Lateral movement

Monitor for unusual process chains like PowerShell spawning cmd.exe, off-hours remote execution via WinRM, and credential dumping artifacts. Correlate network flows with host logs to distinguish administrative work from attacker progression. Focus on the sequence of actions rather than isolated events.

Read the full guide: Detect Lateral Movement: Log Signals, Blind Spots and Detection Logic

What to do and how to stay safe: Node.js

• Upgrade all supported Node.js instances to the latest patched versions immediately.
• Audit application code to identify where Brotli decompression occurs, especially with external data.
• Monitor system logs for crashes or unusual memory access patterns in Node.js processes.
• Ensure end-of-life versions are migrated to supported lines, as they will not receive fixes.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Node.js versions are affected by the Brotli vulnerability?

All three supported release lines, 22.x, 24.x, and 26.x, are affected until updated to their respective fixed versions.

Is there active exploitation of this flaw in the wild?

No exploitation in the wild has been reported as of October 22, according to The Hacker News.

Can the public proof-of-concept exploit standard Node.js builds?

The proof-of-concept only achieved code execution on weakened test builds; it caused crashes on standard builds.