A crafted Brotli-compressed stream can make the Brotli decoder bundled in Node.js write out of bounds, which can lead to remote code execution. Applications that decompress Brotli data from untrusted sources are at risk, including through fetch() and zlib Brotli APIs.
Package | Affected |
|---|---|
Node.js 26.x | below 26.12.1 |
Node.js 24.x | below 24.22.1 |
Node.js 22.x | below 22.23.4 |
Node.js 25.x and earlier | all |
Brotli | 1.0.3 to 1.2.0 |
You are affected if your container runs Node.js below 22.23.4 on the 22.x line, below 24.22.1 on 24.x, below 26.12.1 on 26.x, or any release on an end-of-life line (25.x, 23.x, 21.x, 20.x and older). The Node.js project states that end-of-life lines are always affected when a security release occurs, and they receive no upstream fix.
Upgrade to cleanstart/node:26.12.1 (also tagged latest), which includes the fix. Pull by digest:
Tag | Platform | Digest |
|---|---|---|
| linux/amd64 |
|
| linux/arm64 |
|
| linux/amd64 |
|
| linux/arm64 |
|
docker pull cleanstart/node@sha256:fd92997c4a7197a7fad98f7b81ca2cefb879b2edab6b91d9b777ebdd74ffeae2