Node.js Brotli flaw can run code on affected builds
Oct 23, 2026 · Summarized by Fundy Tech from 2 sources
A Brotli decoder flaw in Node.js can let crafted data run attacker-supplied code on affected builds. Node.js has released fixes, and untrusted Brotli data should be treated carefully.
Key points
- Imperva demonstrated code execution on Node.js 24.22.0 for Linux arm64.
- The fixed release is 24.22.1.
- The flaw affects the 22.x, 24.x and 26.x lines.
Why it matters
If you run Node.js applications, especially services that handle compressed web traffic, this could be a real risk. It may affect container images and bundled runtimes too. Small businesses using Node-based apps should update quickly and check deployed artefacts, not just package lists.
Who’s affected: Node.js applications handling Brotli data
What to do
- Update Node.js to a patched release.
- Check container images and bundled runtimes.
- Limit untrusted Brotli traffic where practical.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.