Nodejs Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Nodejs released security updates on October 21 for its three supported release lines 22x 24x and 26x fixing 10 flaws The most serious is a bug in the Brotli decompression code that Nodejs bundles which the project says can allow remote code execution meaning an attacker could run code of their choosing on the affected system Each supported line has one fixed version