Node.js Brotli decoder RCE bug patched in versions 22, 24, and 26

1. Executive summary

Node.js released security updates on 21 October 2026 for its three supported release lines (22.x, 24.x and 26.x), fixing 10 flaws. The most serious is a bug in the Brotli decompression code bundled with Node.js, which the project says can allow remote code execution. No CVE identifier, CVSS score, severity rating or CISA KEV status is available for any of the 10 flaws, so this advisory cannot rank them by score and does not. Any EMEA financial services estate running Node.js 22, 24 or 26 in internet-facing services, API gateways, or build and CI tooling is exposed until it moves to the fixed build for its line.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The source establishes the following and no more: Node.js shipped updates on 21 October 2026 across three supported lines; 10 flaws were fixed; the most serious is in the Brotli decompression code that Node.js bundles; the project states that flaw can allow remote code execution. Each supported line has one fixed version. The source does not name the fixed version numbers, the CVE identifiers, the affected component beyond "Brotli decompression code", or the mechanism by which the flaw is reached.

A confirmed attack chain cannot be written from this material. What follows is the sequence the source supports, with the gaps stated rather than filled.

A target runs a Node.js 22.x, 24.x or 26.x build that predates the 21 October 2026 update.
The target processes attacker-supplied data through the bundled Brotli decompression path. The source does not state which Node.js API, module or built-in consumer reaches that path, so whether exposure requires an application to call a Brotli API directly, or whether a built-in HTTP or compression path reaches it without application code, is not established here.
The project states the flaw can result in remote code execution. The source gives no exploitation preconditions, no proof-of-concept detail, and no indication of whether exploitation has been observed in the wild.

The remaining nine flaws are not described in the source at all. Their component, impact and severity are unknown from this material.

Two national CERT advisories in the related sources describe earlier, separate Node.js vulnerability disclosures (ANSSI CERTFR-2026-AVI-0786 of 19 June 2026 and CERTFR-2026-AVI-0947 of 30 July 2026; BSI WID-SEC-2024-0393). They are not coverage of this October update and should not be read as corroboration of it. Their generic impact language (remote code execution, denial of service, data confidentiality and integrity, privilege escalation, file manipulation) describes the Node.js flaw population generally, not the Brotli decoder bug specifically. No source in this set names an actor, a campaign, or in-the-wild exploitation.

4. Mitigation & containment

P1 (within 24 hours)

Inventory every Node.js runtime in the estate and record its line and exact version: application servers, containers and base images, serverless runtimes, API gateways, and developer and CI build agents. The Brotli code is bundled with the runtime, so an application-level dependency scan will not surface it; the runtime version is the control.
Upgrade to the fixed build for each line (22.x, 24.x and 26.x each have one fixed version per the project). The source does not print the version numbers; take them from the Node.js release announcement at https://nodejs.org/en/blog before scheduling the change, and do not assume a version from memory.
Where an internet-facing service cannot be patched inside 24 hours, restrict inbound access to it at the edge and log the exception with an owner and a patch date.

P2 (within 72 hours)

Rebuild container images from patched base images rather than patching running containers in place, and confirm the runtime version inside the rebuilt image, not just in the Dockerfile.
Pin the Node.js runtime version in CI configuration so a build cannot silently resolve to an unpatched line, and fail builds that report a version below the fixed build for their line.
Check for side-by-side or forgotten runtimes: vendored Node.js binaries inside tooling, Electron-style embedded runtimes, and older lines still present on build hosts.

P3 (within 7 days)

Add runtime-version reporting to asset inventory so the next Node.js security release can be triaged against a known population rather than a fresh discovery exercise.
Review whether any service accepts Brotli-compressed request bodies from untrusted clients and whether that path can be disabled or size-capped until the runtime is confirmed patched.

5. Indicators of compromise

No indicators of compromise available in the source material.

The source names no hashes, filenames, paths, network indicators or behavioural artefacts. The only actionable identifier is the runtime version itself, which is a patch target rather than an indicator.

6. Detection

Insufficient indicators to author detection rules.

The source gives no distinctive strings, command-line flags, file paths, registry keys or behavioural artefacts specific to this flaw. A rule keyed on the string "Brotli" or on Node.js version banners would match legitimate software and reporting about the flaw, not exploitation of it, so none is emitted. Detection for this item rests on runtime version inventory (see §4), not on signature content.

7. Sources

The Hacker News, "Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions", https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html, 22 October 2026.
ANSSI France CERT, "Multiples vulnérabilités dans Node.js" (CERTFR-2026-AVI-0947), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0947/, 30 July 2026. Separate earlier disclosure; not coverage of this update.
ANSSI France CERT, "Multiples vulnérabilités dans Node.js" (CERTFR-2026-AVI-0786), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0786/, 19 June 2026. Separate earlier disclosure; not coverage of this update.
BSI Germany, "[UPDATE] [hoch] Node.js: Mehrere Schwachstellen" (WID-SEC-2024-0393), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0393. Separate earlier disclosure; not coverage of this update.

8. Adverse Trace position

Adverse Trace assesses this as a patch-now item with an unquantified severity: the project states remote code execution, but no CVE, CVSS score or KEV status is available, so we do not assign a rating and will not present one until NVD and CISA KEV entries exist. The client impact is broad rather than deep: Node.js 22, 24 and 26 are common in EMEA financial services API and integration layers, and the flaw sits in the bundled runtime, so dependency scanning will miss it. The single-source limitation applies to the technical detail here; the Hacker News report is the only source describing this October update, and the fixed version numbers must be taken from the Node.js release announcement before any change is scheduled. Adverse Trace will monitor NVD and CISA KEV for CVE assignment and exploitation status on the Brotli decoder flaw and the other nine fixes, and will reissue this advisory with scores and indicators when they resolve. Clients should confirm their Node.js runtime inventory and patch path to the fixed build for each line within 24 hours.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.