Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js shipped security updates on October 21 for its 22.x, 24.x, and 26.x release lines, addressing ten vulnerabilities. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decompression library that could lead to remote code execution whenever an app decompresses attacker-supplied Brotli data, whether via node:zlib or an automatic fetch() response. Fixed releases are 22.23.4, 24.22.1, and 26.12.1, while end-of-life Node.js 20.x and earlier will not get the patch. A public proof-of-concept only achieved code execution on a deliberately weakened build, causing just a crash and limited memory read on standard builds, and no real-world exploitation has been confirmed.

The same updates also fix three other high-severity bugs—two TLS hostname-validation bypasses (CVE-2026-106069, CVE-2026-105483) and a dns.resolve truncation issue (CVE-2026-105482)—plus several medium and low issues, including a weak randomUUID()/randomInt() reuse flaw (CVE-2026-106074) in snapshot or single-executable builds. Separately, Node.js now blocks eight compromised eMudhra intermediate CA keys and drops three emSign root certificates, mirroring a similar move by Go. Bundled components undici, c-ares, OpenSSL, and SQLite were also updated to resolve known vulnerabilities, and since no workaround exists for the Brotli flaw, administrators are urged to upgrade promptly.