Node.js Brotli Decoder RCE Confirmed on Standard 24.22.0 Arm64 Build via Invalid Block Transition
A production Node.js build was shown vulnerable to RCE through its bundled Brotli decoder when processing malformed streams. The flaw stems from missing validation on block-type transitions and affects any path that decodes untrusted Brotli data. Fixes exist only on supported lines; container fleets and EOL branches remain exposed until rebuilt.
Next steps include inventory scans for bundled Node binaries and replacement of 20.x workloads. Independent confirmation of the Imperva PoC on additional architectures remains absent; until that data appears, the scope of affected production fleets is still estimated rather than measured.
Node.js security team: 35% of 24.x container images on Docker Hub will still contain the vulnerable Brotli decoder 60 days after disclosure.
Sources (3)
- [1]Node.js Security Release October 2026(https://nodejs.org/en/blog/vulnerability/october-2026-security-releases/)
- [2]Imperva Node2Shell Technical Report(https://www.imperva.com/blog/node2shell-rce-analysis/)
- [3]Brotli Upstream Patch Commit(https://github.com/google/brotli/commit/8e7a6e7)