Skip to content
Node.js Fixes Critical Remote Code Execution Flaw in Brotli Compression

Node.js Fixes Critical Remote Code Execution Flaw in Brotli Compression

First seen 23 Oct 2026, 17:14 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 18:15 UTC
  • •CVE-2026-111497 is a critical remote code execution vulnerability in Node.js.
  • •Over 6 million websites, including major services, could be affected.
  • •Administrators are urged to apply patches immediately to mitigate risks.

Node.js has patched a critical vulnerability (CVE-2026-111497) affecting its Brotli decompression feature, which could allow remote code execution or cause service disruptions. This flaw impacts applications running on Node.js versions 26.x, 24.x, and 22.x, potentially affecting over 6 million websites, including major platforms like Netflix and PayPal. While proof-of-concept code has been published, no real-world attacks have been reported yet. Administrators are urged to update their systems and test key functionalities to mitigate risks. The vulnerability is particularly dangerous as it allows attackers to control decompressed Brotli data, leading to memory leaks or arbitrary code execution. Node.js has emphasized the urgency of applying the patch to prevent exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
Node.js vulnerability CVE-2026-111497 published
Node.js disclosed a critical flaw in its Brotli decompression feature that could lead to remote code execution.
Cybernews
2026-10-22
Proof-of-concept code released
Researchers published proof-of-concept code for CVE-2026-111497, increasing the urgency for patching.
X
2026-10-22
CVE-2026-110264 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
Public exploit for CVE-2026-105482 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-23
Public awareness of vulnerabilities
Aikido Security reported multiple critical vulnerabilities in various platforms, including Node.js.
X

More articles in this cluster (2)

Following this threat?

Track Mozilla and CVE-2026-105481 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (24)

1 / 2

Common questions

Which versions of Node.js are affected?
Node.js versions 26.x, 24.x, and 22.x are affected by the vulnerability.
Is there evidence of active exploitation?
No confirmed real-world attacks have been reported yet, but proof-of-concept code is available.
What steps should administrators take?
Administrators should update Node.js, rebuild affected images, and test key functionalities immediately.