Node.js patches Brotli code execution across three release lines The October security releases fix a native decompression flaw, certificate checks and permission bypasses. Updating dependencies alone leaves the runtime unchanged.