Node.js Patches a Brotli Bug That Squeezes Past Its Own Buffer
Node.js fixed an out-of-bounds write in its bundled Brotli decoder (CVE-2026-111497) that it says could allow remote code execution on 22.x, 24.x and 26.x. End-of-life versions get no patch.
Node.js shipped security releases on Oct. 21 for every supported line, and the headline fix is a memory-corruption bug in the bundled Brotli decompressor that the project says could allow remote code execution. Malformed compressed data can make the decoder write past the end of its buffer, The Hacker News reports. The Node.js advisory rates it High and offers no workaround, so upgrading is the fix. The same release patches nine other bugs, several of them in TLS hostname checks.
For defenders
CVE-2026-111497 (Brotli out-of-bounds write): High per Node.js; no CVSS score published. Affects 22.x, 24.x and 26.x. Fixed in 22.23.4, 24.22.1 and 26.12.1. Node.js says end-of-life lines (20.x and older) are also affected and won’t get a fix. Credit goes to OpenAI Codex Security, Khai Tran and Sylvie Mayer. The fix comes from upstream Brotli, which shipped it in 1.2.1, 1.1.1 and 1.0.10, so apps that link their own copy of Brotli need that update too.
Exposure: According to The Hacker News, you’re exposed if you decompress Brotli data an attacker controls through node:zlib or fetch(). That covers compressed request bodies and compressed responses pulled from other servers.
Exploitation: None reported in the wild as of Oct. 22. The Hacker News says a public PoC appeared the same day but only got code execution on a deliberately weakened build. On a standard build, its author got a crash and a limited memory read. Treat crash-level denial of service as realistic and RCE as unproven. Vercel added firewall rules for inbound requests but notes they don’t cover responses fetched from other servers.
Also in this release (Node.js severities):
| CVE | Issue | Severity |
|---|---|---|
| CVE-2026-106069 | TLS hostname check bypass via loosely written IP | High |
| CVE-2026-105483 | TLS hostname check bypass via fullwidth-digit IP (24.x, 26.x) | High |
| CVE-2026-105482 | dns.resolve truncates names at a NUL byte | High |
| CVE-2026-105481, -106072, -106074 | Keep-alive response mix-up, IPv4 SAN confusion, repeated randomUUID()/randomInt() values in snapshots and SEAs | Medium |
| CVE-2026-106070, -106071, -106073 | ZipFile and Permission Model issues | Low |
The releases also update undici, c-ares, OpenSSL (22.x, 24.x) and SQLite (22.x). They also block eight compromised eMudhra intermediate CA keys. The Hacker News notes that Node.js doesn’t check revocation by default, so that block only reaches you after you upgrade.
What it means for you
Node.js is the engine behind a huge number of websites, web apps and developer tools. If you don’t run servers or write software, there’s nothing for you to install. Services you use will patch on their end. If you run a small business site or app built on Node.js, or someone built one for you, ask whoever maintains it to update Node.js this week. Older versions like Node 18 or 20 won’t receive this fix at all, so they need a move to a supported version.
Do this now
- Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, and rebuild container images, since base images pin Node versions.
- Find anything still on Node.js 20.x or older (run
node -vacross hosts and check Dockerfiles) and plan a migration. There’s no patch coming for those. - Until you’ve patched, check whether your apps accept Brotli-compressed request bodies or fetch content from servers you don’t control. Fix those services first.
- Bundled Node runtimes in desktop apps, CLIs and single-executable apps don’t update with your system Node. Check vendors for updated builds.
CVE at a glance
- CVSS
- 9.2 Critical (v4.0)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 10 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.