Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

The Hacker News · Thursday, 22 October 2026 at 07:47 (5h ago) · Original article ↗

Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.

Each supported line has one fixed version:

You're reading a preview. The full article is published by The Hacker News on their website.

Read the full story on The Hacker News

Security

Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed

The Register 16m ago

Security

What’s going on with the web? The PHP issue and sites going offline

A significant number of websites have gone offline, and that’s not due to a service outage, but rather a deliberate decision by the site’s owners. The reason is because extremely dangerous security vulnerabilities have been found in a protocol used by most websites – PHP. This…

9to5Mac 21m ago

Security

GitLab warns of new max severity code execution vulnerability

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...]

BleepingComputer 50m ago

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

More Security & Privacy

Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

What’s going on with the web? The PHP issue and sites going offline

GitLab warns of new max severity code execution vulnerability