Node.js patches Brotli decoder flaw that could allow remote code execution

The Node.js project released security updates on October 21 for all supported release lines, fixing ten vulnerabilities including CVE-2026-111497, a high-severity out-of-bounds write in the bundled Brotli decoder that the project says permits remote code execution. Users should upgrade to Node.js 26.12.1, 24.22.1 or 22.23.4, since the advisory offers no workaround for the Brotli flaw.

What happened

According to the Node.js advisory, CVE-2026-111497 affects the 22.x, 24.x and 26.x lines and was reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer. The Hacker News reported that the bug is triggered by malformed compressed input and that the fix is an upstream Brotli patch that makes the decoder reject invalid data before writing past its buffer. The same fix shipped in Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21.

The Hacker News also reported that a public proof-of-concept appeared on October 22, but it achieved code execution only against a deliberately weakened test build. On a standard build, its author reported a crash and a limited read of process memory. No in-the-wild exploitation had been reported as of October 22.

Technical details

Applications are exposed when they decompress attacker-controlled Brotli data, such as request bodies or responses fetched from other servers, including automatic decompression performed by fetch(), according to The Hacker News.

The releases fix three other high-severity issues: CVE-2026-105482, where dns.resolve truncates names containing a NUL character, and two TLS certificate hostname-check bypasses, CVE-2026-106069 and CVE-2026-105483, involving non-canonical or fullwidth-digit IP address forms. Medium-severity fixes include CVE-2026-106074, under which crypto.randomUUID() and randomInt() values repeat across processes started from startup snapshots or single-executable apps, and CVE-2026-105481 affecting keep-alive sockets. Three low-severity Permission Model and ZipFile issues were also addressed.

The bundled CA certificate store was updated to respond to the eMudhra intermediate CA compromise, and c-ares, undici, OpenSSL and SQLite were updated on various lines.

Who is affected

All users of Node.js 22.x, 24.x and 26.x are affected. Node.js says end-of-life versions are also affected by these issues but will not receive fixes, so teams still running Node.js 20.x or older should move to a supported release.

What to do

Upgrade to 26.12.1, 24.22.1 or 22.23.4 and rebuild container images and single-executable apps that embed Node.js. Check whether services decompress untrusted Brotli content. The Hacker News noted that Vercel added firewall rules on October 21 that block the attack in inbound requests, but these do not cover responses an application fetches from other servers and are not a substitute for upgrading.