Skip to content
Node.js Patches Critical Brotli Decoder RCE Vulnerability

Node.js Patches Critical Brotli Decoder RCE Vulnerability

First seen 22 Oct 2026, 07:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 09:14 UTC
  • •Node.js patched a critical RCE vulnerability in the Brotli decoder (CVE-2026-111497).
  • •The flaw allows remote code execution via malformed Brotli data, affecting all supported Node.js versions.
  • •No exploitation in the wild has been reported as of October 22, 2026.

On October 21, 2026, Node.js released security updates for versions 22.x, 24.x, and 26.x, addressing 10 vulnerabilities, including a critical out-of-bounds write flaw in the Brotli decoder (CVE-2026-111497) that could allow remote code execution. The flaw affects all supported versions and is triggered by malformed compressed input. While a public proof-of-concept was released on October 22, it reportedly only achieved limited results against a weakened test build. Node.js has not observed any exploitation of the flaw in the wild as of the latest reports. Other high-severity vulnerabilities include issues in TLS hostname verification and DNS resolution. Users are advised to upgrade to the patched versions: 22.23.4, 24.22.1, and 26.12.1. The vulnerability is particularly concerning as it affects applications that decompress Brotli data controlled by an attacker.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Node.js security updates released
Node.js released versions 22.23.4, 24.22.1, and 26.12.1 to fix 10 vulnerabilities, including a critical Brotli decoder flaw.
Thehackernews
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
Public proof-of-concept published
A proof-of-concept for CVE-2026-111497 was released, achieving limited results against a weakened test build.
Thehackernews
2026-10-22
Public exploit for CVE-2026-111497 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-22
Public exploit for CVE-2026-105482 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub

More articles in this cluster (3)

Following this threat?

Track CVE-2026-105481 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (25)

1 / 3

Common questions

Which Node.js versions are affected?
All supported versions, specifically 22.x, 24.x, and 26.x, are affected by the Brotli decoder vulnerability.
Is there a patch available?
Yes, Node.js has released patched versions 22.23.4, 24.22.1, and 26.12.1 that address the vulnerabilities.
What should I do if I'm using an affected version?
Upgrade to the latest patched version immediately to mitigate the risk of exploitation.