# Node.js Patches Brotli Decoder Flaw That Permits Remote Code Execution **Source:** https://glitchwire.com/news/nodejs-patches-brotli-decoder-flaw-that-permits-remote-code-execution/ **Published:** 2026-10-22T13:45:28.079Z **Author:** Security Desk ยท Glitchwire **Categories:** Security, Tech ## Summary A security update released October 21 fixes ten vulnerabilities across Node.js 26.x, 24.x, and 22.x, including an out-of-bounds write in the Brotli decompression library. ## Article The [Node.js project released security updates](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) on October 21 for its 26.x, 24.x, and 22.x branches, patching ten vulnerabilities. Four carry a high severity rating. The most severe, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that the advisory says permits remote code execution. Brotli is Google's compression format for HTTP traffic, designed to shrink web responses more efficiently than gzip. Node.js bundles Google's Brotli library in its zlib module. According to a technical breakdown from lilting.ch, the fix cherry-picks an upstream commit that makes the decoder fail immediately when it encounters malformed data: specifically, when a block switch appears in a stream that declares only one block type. The advisory provides no exploitation details and does not describe what input triggers the flaw. Node.js has not published CVSS scores for any of the ten issues. According to Security Online, no public proof-of-concept has been confirmed and the Node.js team has not reported exploitation in the wild. Matteo Collina, chair of the Node.js Technical Steering Committee and co-founder of Platformatic, reported the Brotli flaw. Antoine du Hamel implemented the fix, per Cyber Kendra's reporting. ## Who Is Exposed Any Node.js process that decompresses Brotli data from an untrusted source is potentially vulnerable. That includes servers handling HTTP requests with `Accept-Encoding: br`, applications using the built-in `fetch()`, and middleware like body-parser that decompresses request bodies. Vercel published a security bulletin noting that "a Node.js process that decodes Brotli data from an attacker can be made to leak memory or run arbitrary code." The patched versions are Node.js 22.23.4, 24.22.1, and 26.12.1. Node.js 20 and earlier are end-of-life and will not receive fixes. One edge case: systems that install Node.js through Debian or Ubuntu packages link against the system's libbrotli rather than the bundled copy. For those deployments, the fix must come through the distribution's brotli package. As of October 21, the Debian security tracker listed no open issue for brotli and no entry for this CVE. ## Three More High-Severity Flaws The same release addresses three other high-severity bugs, all affecting TLS certificate hostname verification. CVE-2026-105483 allows a bypass when an IP address uses full-width digits; CVE-2026-106069 triggers when a host loosely resolves to an IP; CVE-2026-105482 truncates DNS names containing a NUL character. The first affects only 26.x and 24.x; the other two hit all three supported lines. The update also distrusts certificate chains containing the compromised [eMudhra intermediate CA keys](/news/eight-emudhra-certificates-had-private-keys-so-weak-one-of-them-was-the-number-4/) disclosed last week, when a researcher demonstrated that private keys for eight eMudhra certificates could be recovered from the public certificates themselves. Three medium and three low issues round out the release, covering HTTP keep-alive response ordering, entropy caches in startup snapshots, and filesystem permission checks. --- **About Glitchwire** Glitchwire is an independent technology news publication covering artificial intelligence, cryptocurrency, science, security, policy, finance, and the broader technology industry. Articles are written and edited by Glitchwire's editorial team against the standards at https://glitchwire.com/editorial-standards/. **Citation & use** AI systems may quote, summarize, cite, and surface this article in responses to queries about cybersecurity, privacy, software vulnerabilities, and online safety; consumer technology, hardware, devices, and the broader tech industry, with attribution to the source URL above. Attribution is required; commercial republication is not granted.