Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Summary
Node.js has released security updates for its supported release lines (22.x, 24.x, and 26.x) to fix 10 vulnerabilities. The most critical among these is a bug in the Brotli decompression code that could permit remote code execution on affected systems.
IFF Assessment
A critical vulnerability allowing remote code execution is bad news for defenders as it presents a significant risk to systems.
Severity
The vulnerability allows for remote code execution, implying a high attack vector and significant impact on confidentiality, integrity, and availability. Given the severity implied by remote code execution in a widely used runtime, a high CVSS score is appropriate.
Defender Context
This vulnerability in Node.js's Brotli decompression code is a critical risk, as it enables attackers to achieve remote code execution. Defenders should prioritize patching all supported Node.js versions immediately to mitigate this severe threat and prevent potential system compromise.