Overview
- Node.js published security releases on October 21 that fix ten vulnerabilities and include patched builds 22.23.4, 24.22.1, and 26.12.1 to address the Brotli flaw.
- The root problem, tracked as CVE-2026-111497, is an out-of-bounds write in the bundled Brotli C decoder that can be triggered by crafted compressed input and can lead to remote code execution.
- Public proof-of-concept code first achieved execution only on a weakened test build, and researchers at Imperva later demonstrated RCE against an official 24.22.0 Linux arm64 image while reporting no signs of wide exploitation.
- Any software that bundles the same Brotli decoder is at risk, and the bug can be reached either when Node.js automatically decompresses Brotli responses via fetch() or when server middleware decodes Brotli request bodies such as Express 5 with body-parser.
- There is no in‑runtime workaround so teams must upgrade every pinned Node binary, container image, CI artifact, and serverless runtime; some providers added firewall rules that only partially reduce risk and end-of-life Node 20.x and earlier will not be patched.