Node.js' October 21 security release fixes 10 flaws across 22.x, 24.x and 26.x.
The most serious is an out-of-bounds write in the bundled Brotli decoder that could permit remote code execution.
A published proof of concept achieved code execution only on a deliberately weakened test build; standard builds experienced a crash and limited memory read.
Fixed releases are 22.23.4, 24.22.1 and 26.12.1; 20.x and earlier are end-of-life.
The new patched versions are 22.23.4 and 24.22.1 for the long-term support series, and 26.12.1 for the current series. Older versions, such as the 20.x series, have reached end of support and will not receive the update.
Where is the compression problem located?
The issue concerns the built-in tool that handles data compression and decompression. This code is automatically triggered when the system processes compressed data, either in specific operations or when receiving data from other servers.
Tests published on October 22 showed that a test attack could only achieve code execution against a specially weakened test system. In regular versions, the same process would simply cause a shutdown or limited memory reading. So far, no attempts to exploit the problem in practice have been reported.
READ ALSO
Two critical PHP vulnerabilities: attack attempts before public disclosure
Other important issues fixed
In addition to the core compression issue, the update fixes several other issues, including:
- Security gaps in server name verification.
- An issue where network address lookup was prematurely truncating names that contained a special character.
- Several medium and low severity issues.
- Updates to built-in additional tools and libraries.
Blocking suspicious certificates
The update also blocks eight compromised intermediate certificate authority keys from Indian company eMudhra and removes three key roots of emSign.
What users should do
Users must upgrade to the new versions to be protected. Vercel said it added additional security rules to its systems on October 21 to block the attacks, but stressed that these rules are not a substitute for updating the software.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)