Thursday, October 22, 2026 · 3 of 5

1. Node.js ships fixes for a Brotli decoder write bug that can lead to RCE

   On 22.x, 24.x and 26.x. Node 20 and older get nothing.

   Oct 21Security