/
← Voltar ao feed
high

Node.js patches Brotli decoder out-of-bounds write (RCE per vendor) and 9 other flaws; blocks eight compromised eMudhra CA keys

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 04:47 · coletado há 13 horas

Node.js released security updates on October 21 for the 22.x, 24.x and 26.x lines (fixed in 22.23.4, 24.22.1 and 26.12.1), addressing 10 flaws. The most serious is an out-of-bounds write in the bundled Brotli decoder, which the project says could allow remote code execution. It is rated high, not critical. A public proof-of-concept published October 22 achieved code execution only against a deliberately weakened test build. On standard builds it produced a crash and a limited memory read, and no in-the-wild exploitation had been reported as of October 22. The same updates also block eight intermediate CA keys from Indian provider eMudhra that were reported compromised, and remove three emSign roots from the bundled root list.

Entenda a falha

A vulnerabilidade

The most severe flaw is an out-of-bounds write in the Brotli decoder bundled with Node.js, triggered by malformed compressed input. The Node.js project says it could allow remote code execution but rates it high, not critical. No CVE is stated for it in the article. An application is exposed when it decompresses attacker-controlled Brotli data, such as request bodies or responses fetched from another server. Fixed in 22.23.4, 24.22.1 and 26.12.1; 20.x and earlier are end of life and get no fix. Three other high-severity bugs: two TLS certificate check bypasses using unusual IP address forms (CVE-2026-106069, CVE-2026-105483), and dns.resolve cutting hostnames at an embedded null byte (CVE-2026-105482). A medium one, CVE-2026-106074, makes crypto.randomUUID() and crypto.randomInt() repeat values across processes in startup-snapshot or single-executable apps.

Como funciona

Node.js runs the bundled Brotli decoder whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when fetch() receives a Brotli-compressed response. If that data is malformed, the decoder processes it and, at some point, writes past the end of its buffer instead of rejecting the input. For the TLS bugs, a server's IP address written in an unusual form makes the certificate check match a host it should not. For the dns issue, dns.resolve stops reading a hostname at an embedded null byte and resolves a shortened name.

Por que é vulnerável

For Brotli, the decoder did not catch certain invalid input and kept going, which allowed the write past the buffer. The fix is an upstream Brotli patch that makes the decoder detect invalid input and stop earlier. The change was made in Brotli's source in February 2026 but shipped as a security release only in October. The articles give no root cause for the TLS, dns.resolve or randomUUID bugs beyond what the symptoms show: unusual IP forms accepted in certificate checks, truncation at a null byte, and identical random values from snapshot builds.

Onde está

The flaw is in the Brotli decoder bundled with Node.js, reached through node:zlib and fetch(); the articles name no file or function, only the upstream Brotli patch of February 2026. The other bugs are in dns.resolve, crypto.randomUUID()/randomInt() and the TLS certificate check.

Como foi descoberta

The articles do not say who found the Brotli flaw or how. They say the fix was first made in Brotli's source in February 2026 and shipped as a security release only on October 21, 2026, together with Brotli 1.2.1, 1.1.1 and 1.0.10 and the Node.js updates. It was disclosed through the Node.js security release. For CVE-2026-105483, the fixing commit itself calls the bug low-severity and hard to exploit, while Node.js rates it high. No in-the-wild exploitation had been reported as of October 22.

PoC pública

A public proof-of-concept for the Brotli flaw was published on October 22; the articles do not name its author. It reached code execution only against a deliberately weakened test build. On a standard Node.js build its author reported a crash and a limited read of process memory, and said a working attack on a normal build was not achieved. Patched Node.js rejects the malformed input it uses. It is an early-stage PoC, not a working exploit, but it shows the bug is reproducible, so patching remains urgent for apps that decompress untrusted Brotli data.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 08:16.

Detalhes técnicos

  • Brotli flaw: an out-of-bounds write in the decoder, triggered by malformed compressed input. No CVE is stated in the article. Node.js reaches the code through node:zlib or automatically through fetch() on Brotli-compressed responses. Applications are exposed when they decompress attacker-controlled Brotli data, such as request bodies or responses fetched from another server.
  • The fix is an upstream Brotli patch, first made in Brotli's source in February 2026 and shipped as a security release in October. It also shipped in Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21, so other software bundling Brotli may need updating.
  • Other high-severity fixes: two TLS certificate check bypasses that use unusual IP address forms (CVE-2026-106069, CVE-2026-105483), and dns.resolve truncating hostnames at an embedded null byte (CVE-2026-105482). The commit fixing CVE-2026-105483 calls it low-severity and hard to exploit.
  • Medium flaw: CVE-2026-106074 makes crypto.randomUUID() and crypto.randomInt() return the same values across processes in startup-snapshot or single-executable applications.
  • eMudhra block: Node.js does not perform revocation checks by default, so chains built on the compromised keys previously validated. Sessions resumed from before the update are not re-checked until they time out. Go made the same block on October 20.
  • Bundled components refreshed: undici (three moderate advisories, including a Subresource Integrity check issue and two memory-exhaustion flaws), c-ares, OpenSSL (22.x and 24.x) and SQLite (22.x).

Remediação

  • Upgrade to 22.23.4, 24.22.1 or 26.12.1. Node.js 20.x and earlier are end of life and get neither the fix nor the eMudhra block, so they must move to a supported line.
  • The advisory offers no workaround for the Brotli flaw.
  • Vercel added firewall rules on October 21 that block the attack in inbound requests. They do not cover Brotli responses fetched from other servers and do not replace upgrading.
  • Check other software that bundles Brotli for the corresponding patched versions.

Linha do tempo

  1. thehackernews.com ↗ · pub. 22/10/2026 04:47 · coletado 22/10 08:00 primeiro registro

    Node.js patches Brotli decoder out-of-bounds write (RCE per vendor) and 9 other flaws; blocks eight compromised eMudhra CA keys

    ler a análise desta fonte

    Node.js released security updates on October 21 for the 22.x, 24.x and 26.x lines (fixed in 22.23.4, 24.22.1 and 26.12.1), addressing 10 flaws. The most serious is an out-of-bounds write in the bundled Brotli decoder, which the project says could allow remote code execution. It is rated high, not critical. A public proof-of-concept published October 22 achieved code execution only against a deliberately weakened test build. On standard builds it produced a crash and a limited memory read, and no in-the-wild exploitation had been reported as of October 22. The same updates also block eight intermediate CA keys from Indian provider eMudhra that were reported compromised, and remove three emSign roots from the bundled root list.

    Technical Details

    • Brotli flaw: an out-of-bounds write in the decoder, triggered by malformed compressed input. No CVE is stated in the article. Node.js reaches the code through node:zlib or automatically through fetch() on Brotli-compressed responses. Applications are exposed when they decompress attacker-controlled Brotli data, such as request bodies or responses fetched from another server.
    • The fix is an upstream Brotli patch, first made in Brotli's source in February 2026 and shipped as a security release in October. It also shipped in Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21, so other software bundling Brotli may need updating.
    • Other high-severity fixes: two TLS certificate check bypasses that use unusual IP address forms (CVE-2026-106069, CVE-2026-105483), and dns.resolve truncating hostnames at an embedded null byte (CVE-2026-105482). The commit fixing CVE-2026-105483 calls it low-severity and hard to exploit.
    • Medium flaw: CVE-2026-106074 makes crypto.randomUUID() and crypto.randomInt() return the same values across processes in startup-snapshot or single-executable applications.
    • eMudhra block: Node.js does not perform revocation checks by default, so chains built on the compromised keys previously validated. Sessions resumed from before the update are not re-checked until they time out. Go made the same block on October 20.
    • Bundled components refreshed: undici (three moderate advisories, including a Subresource Integrity check issue and two memory-exhaustion flaws), c-ares, OpenSSL (22.x and 24.x) and SQLite (22.x).

    Remediation

    • Upgrade to 22.23.4, 24.22.1 or 26.12.1. Node.js 20.x and earlier are end of life and get neither the fix nor the eMudhra block, so they must move to a supported line.
    • The advisory offers no workaround for the Brotli flaw.
    • Vercel added firewall rules on October 21 that block the attack in inbound requests. They do not cover Brotli responses fetched from other servers and do not replace upgrading.
    • Check other software that bundles Brotli for the corresponding patched versions.