Node.js Patches Severe Brotli Bug That Enables Remote Code Execution

Node.js just shipped one of its biggest security patches of the year, and if you run a Node server, a Docker container, or even a single compiled executable built with it, this is not a patch to leave for next week.

What actually broke

On October 21, the Node.js project released versions 22.23.4, 24.22.1 and 26.12.1, fixing ten security bugs at once, four of them rated high severity. The headline flaw sits in Brotli, the compression format used all over the web to shrink files before they're sent over a network. Node.js bundles its own Brotli decoder, and researchers found an out-of-bounds write in it — a memory bug where the program writes data past the space it was given, which an attacker can abuse to run their own code on your server (remote code execution, or RCE). Since Brotli decompression happens automatically whenever a server or client unpacks compressed data, an attacker doesn't need a password or a login to trigger it; a malicious response is enough.

The rest of the fixes are less dramatic but still worth knowing about: a handful of TLS hostname-checking bugs that could let a certificate for the wrong domain slip through, and a DNS resolution issue where a hostname containing a NUL character wasn't being rejected the way it should have been.

Node.js has not published any workaround for these vulnerabilities. Upgrading is the only fix.

The part everyone forgets: it's not just your server

Most teams think a vulnerability like this means "update the Node.js installed on the production server" and move on. That's not enough here. A Docker image built with an older Node.js base, or a single executable application (SEA) compiled with Node.js, carries its own frozen copy of the runtime inside it. Patching the host machine does nothing for those — they need to be rebuilt from a patched base image and redeployed. If your CI/CD pipeline isn't set up to automatically pull the latest patch version on rebuild, you could be shipping the vulnerable Brotli decoder for weeks without realizing it.

There's also no safety net for anyone still on Node.js 20 or earlier. Node 20 reached end-of-life on April 30, 2026, so it gets no fix for any of these ten issues at all. If that's still powering a production app, the real fix isn't a patch — it's an overdue upgrade to a supported major version.

Why this matters more in India than it might look

India has one of the largest Node.js developer bases in the world, and a huge share of the country's fintech apps, D2C platforms, and SaaS startups run Node.js backends precisely because it's fast to build on and cheap to scale. Many of these teams deploy through Docker and managed container platforms without a formal patch-management process — someone builds an image once, it works, and it quietly runs unchanged for months. That's exactly the gap this vulnerability exploits. With MeitY and CERT-In pushing Indian software vendors harder on vulnerability disclosure and timely patching under recent cybersecurity guidelines, a widely-used runtime shipping a remote-code-execution bug is the kind of thing that should trigger an immediate audit, not a "we'll get to it" ticket.

It's worth noting this release also stripped trust from intermediate certificates tied to the eMudhra certificate authority compromise that Code24 covered earlier this week — a reminder that October 2026 has been an unusually rough month for foundational internet infrastructure, from certificate authorities to the runtimes half the web is built on.

What to actually do about it

• Upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1 depending on which major version your project tracks.
• Rebuild and redeploy any Docker image or single executable application rather than assuming a host-level update covers them.
• If you're on Node.js 20 or older, treat this as a forcing function to move to a supported release line.
• Check CI pipelines to confirm base images actually pull the latest patch tag instead of a pinned older one.

None of this requires exotic tooling or a security team on retainer — it's a version bump and a rebuild. The bigger lesson is less comfortable: a runtime this widely trusted had a remotely-triggerable memory bug sitting in a library almost nobody thinks about until it breaks. Brotli compression is invisible by design, which is exactly why nobody audits it until an advisory forces the issue.