Node.js flaw allowed code execution via crafted Brotli data

Imperva said it had demonstrated code execution on the official Node.js 24.22.0 image for Linux arm64 by supplying crafted Brotli data to the bundled decoder. The same input was rejected on Node.js 24.22.1.

The article said Imperva’s test did not work first time and required several attempts in its setup. It also said the result was limited to that build and environment, with other architectures and the 22.x and 26.x lines not checked.

According to the article, a previous public proof of concept only achieved execution on a deliberately weakened test build. On an ordinary build it produced a crash and a limited memory read, rather than code execution.

Imperva traced the issue to a point where the Brotli stream’s structure made the next block change impossible. The vulnerable decoder treated that state as a need for more input and continued, and a memory-sanitised run then showed an out-of-bounds write.

Node.js fixed the problem by taking an upstream Brotli patch that made the decoder stop with a format error at that point. The article said there was no workaround inside Node.js, so affected users were told to move to a patched release, while Imperva and Vercel both described additional filtering rules as partial measures only.