Brotli Bug Calls for Node.js Runtime Updates, Not App Fixes

A fetch() response compressed with Brotli can reach vulnerable code bundled inside Node.js, even without an explicit node:zlib call. The fix landed October 21 across three supported lines: 22.x, 24.x, and 26.x. This guide maps exposure paths to those fixed builds and separates the demonstrated risk from the project's warning.

For teams running services that decompress attacker-controlled data, the problem sits below application code. The Node.js security updates address 10 flaws, including a Brotli decoder flaw the project says could allow remote code execution. The same releases also change certificate trust and fix other bundled components, so the rollout deserves more than a check for explicit Brotli usage.

How a normal fetch() call reaches the bug

The exposure condition is decompression of Brotli data an attacker controls. That can mean an incoming request body, but it can also mean a response fetched from another server. Looking only at the public-facing request path misses the second route.

Say you maintain a Node.js web service that fetches content from another server. In an existing asynchronous application path, with upstreamUrl supplied by the application, the relevant call can look ordinary:

const response = await fetch(upstreamUrl);

This is an exposure illustration, not a diagnostic or a fix. Node.js can automatically decompress a Brotli response through fetch(); your code does not have to call node:zlib directly. The security question is whether an attacker can control compressed data that reaches that decompression path.

I'd trace both inbound body handling and outbound fetch calls before assigning this only to the request-handling team. Record where compressed data originates and which application paths decompress it. That gives the upgrade discussion a concrete scope instead of relying on whether anyone remembers adding Brotli support.

The patch changes the decoder, not your handlers

Malformed compressed input can trigger an out-of-bounds write in the bundled Brotli decoder. The fix makes the decoder detect invalid input and stop earlier, rather than write past its buffer.

Node.js copied an upstream patch from the Brotli project. The vulnerable code is therefore part of what Node.js ships, not a mistake that must exist in your own program. The corrective release changes the runtime component that processes the input.

An application-package change is not the fix described by the advisory. Treat the runtime update as its own deployment item alongside your application security checks, rather than assuming those checks account for this bundled decoder.

Certificate trust changes reach beyond Brotli traffic

The same releases stop trusting eight intermediate certificate authority keys from the Indian provider eMudhra, which were reported compromised days earlier. This part of the update concerns certificate trust, independently of whether a service handles Brotli data.

Node.js uses the Mozilla root certificate list but does not perform revocation checks by default. Before this update, a certificate chain built on one of those compromised keys could still pass. The releases add a built-in block on the eight keys and remove three emSign roots from the bundled root list.

Test certificate-dependent integrations in staging because the update changes accepted certificate chains. The release changes both input processing and which certificate chains Node.js accepts. Keeping those as separate test concerns makes the rollout easier to assess.

End-of-life Node.js lines do not receive this certificate block either. Moving an older deployment to a supported line addresses more than the headline decoder flaw.

The remaining fixes cover identity checks and randomness

Three other fixes are rated high. Two address TLS certificate hostname-check bypasses involving unusual representations of IP addresses. The third, CVE-2026-105482, stops dns.resolve from truncating a hostname at an embedded null byte.

A separate medium-severity flaw, CVE-2026-106074, affects applications built as startup snapshots or single-executable applications. It causes crypto.randomUUID() and crypto.randomInt() to return the same values in every process, undermining uses that depend on unpredictability.

Inventory snapshot and single-executable deployments because their random values can repeat across processes. Their reason to upgrade is not limited to whether attacker-controlled Brotli reaches the service.

The remaining fixes cover a keep-alive socket processing a response written before its request, another certificate-validation problem, ZipFile returning attacker-controlled bytes after a failed header check, and Permission Model access bypasses. The ZipFile issue and wildcard-based Permission Model issue affect 26.x only; the fs.realpathSync Permission Model bypass affects all supported lines.

Bundled dependencies also change. The undici update fixes three moderate advisories involving Subresource Integrity and memory exhaustion, including the built-in WebSocket client. The releases refresh c-ares on all supported lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x with fixes for publicly known vulnerabilities.

Mitigation and exploit evidence have clear limits

Upgrading is the fix; the advisory offers no temporary Brotli workaround within Node.js. Vercel added firewall rules on October 21 to block attacks in inbound requests, but those rules do not cover Brotli responses fetched from other servers. They do not replace the runtime update.

The public demonstration also needs precise wording. A proof-of-concept published on October 22 achieved code execution only against a deliberately weakened test build. On a standard Node.js build, its author reported a crash and a limited read of process memory, not successful code execution.

The project describes possible remote code execution and rates the flaw high, not critical. Patched Node.js rejects the malformed input used by the demonstration. No exploitation in the wild had been reported as of October 22; that statement describes the available reporting, not a guarantee about future attacks.

The certificate block has a session boundary too. Connections resumed from sessions established before the update are not re-checked until those sessions time out. An upgraded deployment therefore should not be described as immediately revalidating every previously established session.

Upgrade runtimes and check both Brotli paths

The fixed release depends on the supported line already in use. The October 21 security releases are:

• Node.js 22.x: update to 22.23.4 on the long-term support line.
• Node.js 24.x: update to 24.22.1 on the long-term support line.
• Node.js 26.x: update to 26.12.1 on the current line.

Node.js 20.x and earlier have reached end of life and will not receive the fix. Those deployments need a move to a supported line, not a wait for another patch on their existing line.

Use these checks for the rollout, keeping the runtime inventory separate from the application's dependency inventory:

• Record the Node.js line used by each deployed service and match it to the fixed release above. For deployments using clustering and load balancing, include each service instance in that record.
• Identify both incoming Brotli decompression and responses obtained through fetch(). Use those paths to prioritise exposed services, rather than treating an inbound firewall rule as complete coverage.
• Test the replacement runtime against normal application traffic, certificate-dependent integrations and any snapshot or single-executable packaging the application uses.
• Deploy the replacement runtime, then confirm that the intended fixed build is the one serving the application. Keep the resumed-session caveat in the certificate rollout notes.

Upgrade to the fixed release on the supported line the service already runs; migrate end-of-life deployments rather than wait for another patch. I would not wait for a successful standard-build code-execution demonstration: the reported crash, limited memory read and bundled trust changes already give this update practical consequences.