On October 21, Node.js released crucial security updates for its three supported release lines, 22.x, 24.x, and 26.x, to patch ten vulnerabilities. Among them, the most severe is a flaw in the Brotli decompression code that could enable remote code execution. This vulnerability arises from an out-of-bounds write in the Brotli decoder triggered by malformed compressed input. The flaw affects any application decompressing Brotli data controlled by an attacker, such as a request body or server response. The fixed versions are 22.23.4 and 24.22.1 for long-term support lines, and 26.12.1 for the current line. Versions 20.x and earlier are no longer supported and require an upgrade to a supported line.
The fix for this issue was an upstream patch from the Brotli project, which Node.js integrated. It ensures the decoder stops processing invalid input early, preventing writing past the buffer. While a proof-of-concept demonstrated code execution against a weakened test build, it only caused a crash or limited memory read on a standard Node.js build. No real-world exploitation of this flaw has been reported, and patched versions now reject the malformed input used in the proof-of-concept.
In addition to the Brotli flaw, three other high-severity vulnerabilities were addressed. Two involve TLS certificate checks that could be bypassed by manipulating a server's IP address, and another affects the `dns.resolve` function. Node.js also fixed several medium and low-severity issues, such as a flaw in `crypto.randomUUID()` and `crypto.randomInt()` that can return the same values when built as a startup snapshot.
The updates also include measures to block compromised intermediate certificate authority keys from the Indian provider eMudhra. Node.js no longer trusts these keys, and the bundled root list has been updated to enhance security. Beyond these fixes, Node.js updated several bundled components, such as OpenSSL and SQLite, to address known vulnerabilities. Users are advised to upgrade to the latest versions immediately, as no temporary workaround is available for the Brotli flaw.
