Affected Systems

Node.js versions 22.x, 24.x, and 26.x on all architectures. Confirmed RCE on 24.22.0 Linux arm64. Applications decoding untrusted Brotli data via fetch() responses or request body middleware (Express 5.x body parsers, body-parser 2.x) are vulnerable. Fixed in 24.22.1 and corresponding patched releases for 22.x and 26.x lines.

Exploitation Status

Proof-of-concept publicly demonstrated by Imperva achieving remote code execution on official Node.js 24.22.0 build (Linux arm64). No in-the-wild exploitation reported as of October 22, 2026. Exploit reliability varies; RCE required multiple attempts in tested environment.

Business Impact

Critical risk for Node.js applications that decompress Brotli data from untrusted sources—either via HTTP fetch() of external responses or via middleware parsing Brotli-compressed request bodies (common in Express 5 and body-parser 2.x). Successful exploitation grants arbitrary code execution. Container images and bundled Node binaries require updates beyond npm package management. End-of-life Node.js 20.x and earlier will not receive patches. Vercel deployed WAF rules on October 21; Imperva added detection signatures.

Urgency

🔴 Immediate

Recommended Actions

  • Update Node.js to patched releases: 24.22.1 or later for 24.x line, and corresponding fixes for 22.x and 26.x lines released October 21, 2026.
  • Rebuild and redeploy container images and artifacts bundling Node.js binaries; verify runtime version with 'node --version' post-deployment.
  • Migrate applications on Node.js 20.x and earlier to supported release lines (22.x, 24.x, or 26.x) immediately, as no patch will be issued for EOL versions.
  • If immediate patching is not feasible, restrict or block untrusted Brotli-compressed traffic at the WAF or reverse proxy layer for routes using Express body parsers or fetch() of external content.
  • Review application code for use of Express 5.x body parsers (express.json, express.urlencoded, express.text, express.raw) and body-parser 2.x on routes accepting external input; prioritize patching those services.