Tech · 11 d ago
Researchers show a Node.js flaw can run attacker code
Imperva researchers ran code on an official Node.js 24.22.0 build by feeding crafted data to its Brotli decoder. It took several tries and worked on one Linux arm64 setup.
Affected lines
- Node.js 22.x
- Node.js 24.x
- Node.js 26.x
The flaw affects three Node.js lines, reached through built-in fetch() or middleware that decodes Brotli request bodies, such as Express 5's body parsers.
What to do
Node.js released fixes on Oct 21, and applications that decode untrusted Brotli data should update. No attacks in the wild had been reported as of Oct 22.
