Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Posted: Thu Oct 22, 2026 1:09 pm
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix, so they should be moved to a supported line.
Published Date: Oct 22, 2026
More Information:
https://thehackernews.com/2026/10/nodej ... allow.html
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix, so they should be moved to a supported line.
Published Date: Oct 22, 2026
More Information:
https://thehackernews.com/2026/10/nodej ... allow.html