BROTLI DECODER FLAW ENABLES REMOTE CODE EXECUTION (CVE-2026

X • October 22, 2026

⚠️ NODE.JS SECURITY RELEASES: BROTLI DECODER FLAW ENABLES REMOTE CODE EXECUTION (CVE-2026-111497)

The Node.js project shipped security releases on Oct 21, 2026 for all supported lines: 26.x, 24.x and 22.x.

• CVE-2026-111497 (high): an out-of-bounds write in the Brotli decoder permits remote code execution, affecting 26.x, 24.x and 22.x

• CVE-2026-105483 and CVE-2026-106069 (high): TLS certificate hostname validation bypasses

• CVE-2026-105482 (high): dns.resolve truncates names containing a NUL character

• Several medium and low issues, including predictable crypto.randomUUID() values in startup snapshots and SEAs

• Dependency updates for c-ares, OpenSSL, SQLite, Undici and the eMudhra intermediate CA distrust

• Fixed in v26.12.1, v24.22.1 and v22.23.4

Any service that decompresses untrusted Brotli input, such as HTTP responses or uploads, is the exposure to prioritize. Node.js has not reported exploitation in the wild. Upgrade runtimes and rebuild container images and bundled executables, since patching the host alone won't fix embedded runtimes.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Node.js Brotli Vulnerability CVE-2026-111497 Allows Remote Code Execution On October 21, 2026, Node.js released security updates for versions 22.x, 24.x, and 26.x to address CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decoder that could allow remote code execution. The flaw affects any application that decompresses Brotli data controlled by an attacker, including those using the built-in fetch() or body-parser. Users are advised to upgrade to patched versions 22.23.4, 24.22.1, or 26.12.1. The vulnerability has a CVSS score of 9.2, indicating its critical nature. Although a public proof-of-concept was released on October 22, no active exploitation has been reported in the wild. Other vulnerabilities were also patched in this release, including issues related to TLS certificate validation and DNS resolution. Organizations using Node.js are urged to verify their versions and apply updates promptly. 29 sources 73

Extracted Entities

BROTLI DECODER FLAW ENABLES REMOTE CODE EXECUTION (CVE-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (4)

CWE Weaknesses (2)

Platforms (4)

Tools (2)