Node.js Fixes Brotli Decoder RCE Bug

Node.js released security updates on October 21 for versions 22.x, 24.x, and 26.x to fix ten flaws, including a high-severity bug allowing remote code execution. The vulnerability exists in the bundled Brotli decompression code, which Google developed, and affects applications decompressing controlled data. While a proof-of-concept was published on October 22, no wild exploitation has been reported yet.