Node.js patches Brotli decoder flaw in all supported release lines

Node.js released security updates on October 21 for its three supported release lines, fixing 10 vulnerabilities in 22.x, 24.x and 26.x. The most serious issue is CVE-2026-111497, a high-severity out-of-bounds write in the bundled Brotli decoder that the project says could allow remote code execution.

The fixed releases are Node.js 22.23.4 and 24.22.1 for the long-term support lines, plus 26.12.1 for the current line. Node.js 20.x and earlier are end of life and will not receive these fixes, making migration to a supported release line the required remediation path.

Malformed Brotli data can reach bundled decoder code

The vulnerable code is bundled with Node.js rather than supplied by an application developer. It runs when an application decompresses Brotli data through node:zlib, and it can also run automatically when fetch() receives a Brotli-compressed response.

Exposure therefore depends on whether an application decompresses data controlled by an attacker, including a request body or content retrieved from another server. Malformed compressed input can trigger a write beyond the decoder buffer. Node.js incorporated an upstream Brotli patch that detects invalid input and stops processing before that write occurs.

Brotli, Google's compression library, shipped the same correction in versions 1.2.1, 1.1.1 and 1.0.10 on October 21. The underlying source change was made in February 2026, while the security releases arrived in October. Other software that bundles Brotli may also need the corresponding update.

Public test did not show code execution on standard builds

Node.js describes the potential impact as remote code execution, but the published evidence is narrower. A proof of concept released on October 22 achieved code execution only against a deliberately weakened test build. Its author reported that a standard Node.js build crashed and exposed a limited process-memory read, not code execution, and said a working attack against a normal build had not been achieved.

The patched releases reject the malformed input used by that proof of concept. No exploitation in the wild had been reported as of October 22.

Additional fixes affect TLS, DNS, randomness and certificates

Three further high-severity fixes address two TLS hostname-check bypasses and a null-byte hostname truncation issue in dns.resolve. The releases also fix predictable reuse of values from crypto.randomUUID() and crypto.randomInt() in startup snapshots and single-executable applications.

Node.js also blocked eight intermediate certificate authority keys from eMudhra that had been reported compromised. Because Node.js does not perform revocation checks by default, chains built on those keys could previously pass validation. Existing resumed sessions are not rechecked until they expire.

For businesses, the immediate action is to deploy 22.23.4, 24.22.1 or 26.12.1 and identify workloads still running end-of-life versions. Prioritize applications that accept untrusted compressed bodies or fetch Brotli-compressed material from external services, while treating perimeter filtering as temporary risk reduction rather than a replacement for upgrading.