Node.js fixes ten vulnerabilities including a Brotli decoder RCE flaw

The Node.js project released security updates for its 26.x, 24.x, and 22.x lines, patching ten vulnerabilities plus updating bundled dependencies including c-ares, OpenSSL, SQLite, and Undici. The most severe issue is an out-of-bounds write in Node's Brotli decoder that permits remote code execution, rated high severity and affecting all three release lines.

Other high-severity fixes include a flaw where dns.resolve truncates names containing a NUL character, and two separate TLS certificate hostname bypass bugs, one triggered when an IP address is written using fullwidth digits and another when a hostname loosely resolves to an IP address. Medium-severity fixes cover a keep-alive socket issue that can process a response written before its matching request was sent, improper certificate validation for non-canonical IPv4 hostnames, and an issue where crypto.randomUUID() and randomInt() entropy caches get saved into startup snapshots, causing every process built from that snapshot to repeat the same random values.

Low-severity fixes address a ZIP file handling bug that can leak attacker-controlled bytes, a Permission Model bug that over-grants filesystem access through wildcard lookups, and a Permission Model bypass via fs.realpathSync. Node.js versions 22.23.4, 24.22.1, and 26.12.1 contain the fixes.

Why it matters

The Brotli decoder bug allows remote code execution in a core, widely-used part of Node, so any server handling compressed input should update promptly.

Source: Node.js