Node.js Brotli decoder out-of-bounds write

Summary

A crafted Brotli-compressed stream can corrupt adjacent decoder state memory, disclose memory, cause denial of service, or potentially execute arbitrary code. NVD's later CVSS v4.0 assessment is 9.2.

Component: Node.js core / bundled Brotli decoder. Disclosed: 21 October 2026. Last verified: 22 October 2026, 16:45 UTC.

Affected versions

Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. Node.js Project NIST NVD

Fixed versions

Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1. If your application bundles a separate Brotli library, that copy needs its own update. Node.js Project NIST NVD

Conditions and scope

These are the conditions named by the sources. They are not a score and not a prediction.

• The application processes attacker-controlled Brotli-compressed data with an affected decoder.
• NVD says the flaw is in the Brotli decoder across all platforms.
• The official Node.js advisory does not publish a specific attack path; the input condition is an inference from the affected component.

Exploitation status

No public confirmation of exploitation was found in the sources checked for this page. That is not proof it was never exploited.

Severity and scoring

Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.

Scope and separation from PHP2Shell

This is a Node.js core flaw, not an npm package flaw and not part of PHP2Shell. It was released on the same day, which is a coincidence of the security calendar rather than evidence of a shared root cause.

Node.js bundles a Brotli decoder. The official advisory says an out-of-bounds write 'permits remote code execution'. NVD's fuller description attributes the buffer overflow to Brotli 1.0.3 through 1.2.0 and lists memory corruption, disclosure and denial of service as possible outcomes.

Response

Update the Node.js runtime to the fixed release for your line, rebuild container images, and confirm the running process rather than the version in a lockfile. If the application also ships a standalone Brotli library, update that separately.

No exploitation has been publicly confirmed in the sources checked here. Treat that as an evidence boundary, not a clean bill of health.

What to do

• Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
• Interim controls and their limits — how to buy time without claiming a fix.
• Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.

Sources

Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.