Node.js Brotli RCE (CVE-2026-111497): who is exposed and how to patch

On 21 October 2026 Node.js released 22.23.4, 24.22.1 and 26.12.1, fixing ten vulnerabilities. The most serious, CVE-2026-111497, is a flaw in the Brotli decoder that ships inside Node.js: malformed compressed input can write past the end of an internal buffer, which can crash the process, leak memory, or lead to remote code execution. Qualys scores it CVSS 4.0 9.2, and a proof of concept has been published.

An invalid block switch in a Brotli stream was treated as "I need more input" instead of a permanent format error. The streaming decoder therefore kept appending input bytes to an eight-byte internal buffer, past its end. An attacker who can send Brotli data that your application decompresses with node:zlib can use this to corrupt process memory.

The bug needs attacker-controlled Brotli data that your process decompresses. Look for:

• Servers or proxies that decompress request bodies sent with Content-Encoding: br.
• HTTP clients that fetch from URLs a user can choose (webhooks, link previews, image proxies) and decompress br responses.
• Upload handlers that unpack compressed files.

A typical app that only calls its own API is far less exposed, but the safe answer is still to upgrade, because Brotli decoding is easy to reach indirectly through libraries.

• Node.js 22: 22.23.4 or later
• Node.js 24: 24.22.1 or later
• Node.js 26: 26.12.1 or later

Restart every Node process after upgrading (PM2, systemd, containers). Rebuild Docker images rather than only pulling base images you already have cached.

• High: TLS hostname checks could be bypassed with fullwidth-digit IP addresses (CVE-2026-105483) and with leading-zero IPv4 addresses read as octal (CVE-2026-106069); dns.resolve*() silently truncated names at a NUL byte (CVE-2026-105482).
• Medium: a keep-alive socket could accept a response sent before the request (CVE-2026-105481); non-canonical IPv4 spellings could match a certificate's DNS name (CVE-2026-106072); randomUUID() and randomInt() repeated values in processes started from a snapshot or a single executable application (CVE-2026-106074).
• Low: three issues in the ZIP reader and the Permission Model.

Node.js published no official workaround. To narrow the attack surface in the meantime: do not decompress Brotli from untrusted sources, and limit compressed body size and decompression ratio at your reverse proxy or WAF. These steps reduce exposure; they do not make an unpatched runtime safe.

• Node.js, Wednesday, October 21, 2026 Security Releases
• Qualys analysis
• CSA Singapore alert