Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js released security updates on October 21 for release lines 22.x, 24.x, and 26.x, fixing 10 flaws. The most serious is an out-of-bounds write in the bundled Brotli decompression code that the project says could allow an attacker to run code of their choosing on an affected system.