Node.js Security Flaw Lets Hackers Run Code Via Brotli Data

A Node.js security flaw that lets a malicious stream of compressed data take over a server is spreading well beyond its original target, and developers are being told to patch right now. The bug lives in the Brotli decoder, a piece of code that quietly unpacks web traffic all day long, and it can corrupt memory, leak data or, in the worst case, run an attacker's code.

What Happened With This Node.js Security Flaw

According to the Node.js project's own security bulletin, the issue was fixed in releases shipped on October twenty-first. The bulletin describes a Brotli decoder out-of-bounds write that allows malformed compressed input to write past the end of an internal buffer. That can lead to a crash, disclosure of process memory, or remote code execution. The affected lines are Node.js twenty-two, twenty-four and twenty-six, and the project rates it high severity.

The people who found it were researchers on OpenAI's Codex Security team, Khai Tran and Sylvie Mayer, according to the Node.js bulletin. Maintainers Matteo Collina and Antoine du Hamel wrote the fix. In plain terms, the decoder was told a stream was merely waiting for more input when it was actually broken, so it kept going and kept writing where it never should have.

From Theory to a Working Demo

For a couple of days the bug looked more like a warning than a crisis. Then Imperva's Red Team published a proof of concept they call Node2Shell. According to The Hacker News, the team ran code on an official, unmodified Node.js build for Linux on ARM chips, with no debugger and no custom tinkering, simply by feeding crafted data to the bundled decoder.

There are some honest caveats. The demonstration did not work on every attempt and took several tries. It covered only that one build and setup, and the same inputs were rejected on the patched release. No attacks in the wild had been reported as of the latest coverage. Still, an earlier public proof of concept only crashed normal builds, so a working run on a standard image is a real escalation.

Who Is Actually Exposed

Here is the part that matters if you build apps. A program is only at risk when it decodes Brotli data that someone else controls. According to The Hacker News, that happens in two common ways. One is when a service uses the built-in fetch to read a response from another server that is compressed with Brotli. The other is when middleware, such as the body parsers in Express version five, unpacks a Brotli upload. A bare Node.js server does not decode request bodies by itself.

That makes the Node.js security flaw a two-way street. An unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input could be taken over by a malicious server. That is how OpenAI describes the risk, and it is why even small scripts that scrape or call outside services deserve a check.

The Bug Is Bigger Than Node.js

The flaw sits in Google's Brotli library, not only in Node.js. A second report from The Hacker News says the same decoder code ships inside Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Each product bundles its own copy, so each one has to ship its own update. Google fixed its library in versions one point zero point ten, one point one point one and one point two point one.

Python is the sneaky one. If either Brotli package is installed, popular HTTP clients will decode Brotli responses automatically, so an app can be exposed without ever importing the library in its own code. Dependency scanners may also lag, because the official record names Google's repository rather than the Python packages.

Even the scoring is messy. Google rates the bug nine point two out of ten, which is critical on the newer scale. Node.js calls it high, and Red Hat rates it lower. Whatever the label, security agencies including Singapore's cyber agency have urged teams to patch immediately.

Why It Took So Long to Fix

The backstory is almost funny in a painful way. The change that closes the hole landed in Brotli's source code back in February, but nobody realized it was a security fix, and no new release carried it until October twenty-first. OpenAI said the root cause was fixed in source months earlier, but it was not known at the time that it caused a vulnerability. Basically, the cure sat on a shelf with no label on it.

What You Should Do Now

If you run Node.js, update to the patched version for your line: twenty-two point twenty-three point four, twenty-four point twenty-two point one, or twenty-six point twelve point one. Then restart the service and rebuild any container image, since a running process keeps using the old decoder until it restarts. Node.js lines that are past end of life will not get a fix, so they need to move to a supported release.

If you cannot update yet, stop decoding untrusted Brotli. That means rejecting incoming Brotli uploads before any parser touches them, turning off automatic Brotli decoding in HTTP clients, and removing the Python Brotli packages so clients fall back to older formats. Firewall rules help a little, but Vercel itself noted that its protections do not cover responses a function fetches from other servers. Only the update closes the hole. For anyone who ships web apps, this one is worth a quick check before the weekend, and more tech coverage is on the way as vendors roll out their own patches.