Executive brief
Node.js is a runtime environment used to run JavaScript applications on servers. The synchronous compression/decompression functions in Node.js's zlib module can be crashed by exploiting a flaw in how they validate input data structure sizes. An attacker can repeatedly trigger these crashes to cause a denial of service, making applications unavailable until restarted.
Technical details
A flaw in Node.js's synchronous zlib APIs allows an attacker to craft a spoofed TypedArray object with a manipulated byteLength property that triggers a reachable assertion in the C++ binding layer, causing an immediate process crash. All 11 synchronous zlib functions are affected (e.g., deflateSync, inflateSync, gunzipSync). The vulnerability requires network access to a Node.js application that processes untrusted input through these APIs, with no authentication required. Repeated exploitation results in denial of service. Patches are available in Node.js 22.x, 24.x, and 26.x release lines.
Affected products
- OpenJS Foundation Node.js 22.x, 24.x, 26.x
Timeline
- 2026-07-29: disclosed
- 2026-08-04: advisory