Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js has released security updates for its supported versions, addressing 10 vulnerabilities across its 22.x, 24.x, and 26.x release lines. The most severe issue is a bug in the Brotli decompression code that could allow remote code execution, enabling an attacker to run arbitrary code on the affected system. Each of the supported release lines has a corresponding fixed version. The updates were released on October 21. The bug is present in all supported versions of Node.js, making the security updates necessary to prevent potential attacks.