Description
On October 21, 2026, Node.js released a security update to address CVE-2026-111497, an out-of-bounds write vulnerability (CWE-787) in the Brotli decoder bundled with Node.js. Specially crafted, malicious Brotli data supplied by an attacker can cause memory overwrite during decompression, leading to process memory leakage or remote code execution (RCE).
Node.js does not automatically decompress Brotli data by default; applications are affected when application code or a used library decompresses malicious Brotli data from an attacker, whether in an incoming request body or a response actively fetched by the application. Notably, Node.js's fetch() function automatically decompresses responses using Brotli when the Content-Encoding header contains br. Therefore, a malicious server only needs to return a malformed Brotli response to trigger the vulnerability. Public analysis has demonstrated that the vulnerability successfully causes memory leakage and command execution on unpatched versions across all three branches: 26.x, 24.x, and 22.x.
Severity: High
CVSS: Not yet published by NVD at the time of writing
CWE-787: Out-of-bounds Write
Scope of Impact
The vulnerability resides in the Brotli decoder bundled within the Node.js runtime, affecting all three currently supported branches. Affected versions and patches:
Node.js 26.x: Upgrade to 26.12.1 or higher.
Node.js 24.x (LTS): Upgrade to 24.22.1 or higher.
Node.js 22.x (LTS): Upgrade to 22.23.4 or higher.
End-of-Life (EOL) branches (e.g., 20.x and below): Considered permanently vulnerable and will not receive patches; must be upgraded to a supported branch.
Note: Applications are at risk if they process untrusted Brotli data through any pathway, including calling fetch() to external servers (responses with Content-Encoding: br), accepting Brotli-compressed requests, or using Brotli decompression libraries. Runtime management environments (such as Vercel) automatically patch branches 22.x/24.x, but projects still using 20.x must manually switch to a supported branch and redeploy.
Impact
Successful exploitation of the vulnerability can lead to:
Arbitrary code execution on the Node.js process decompressing malicious Brotli data, running with the privileges of that process.
Process memory leakage (which may contain secrets, tokens, or other users' session data).
Lateral movement from the compromised server to related infrastructure; high risk for services that call
fetch()to external sources or receive compressed data from clients.
Mitigation
Upgrade Node.js to 26.12.1, 24.22.1, or 22.23.4 (or later) matching your active branch as soon as possible. Node.js provides no workaround for this vulnerability; upgrading is the required remediation.
Systems running End-of-Life (EOL) Node.js branches must upgrade to a supported LTS branch (24.x or 22.x) and redeploy, as EOL branches will not receive patches.
Audit all Brotli processing pathways handling untrusted sources: services using
fetch()/HTTP clients to external servers, endpoints accepting compressed requests (Content-Encoding: br), and Brotli decompression libraries in dependencies. Rebuild and redeploy containers/images (including base images) after upgrading to ensure the patch is truly deployed.While awaiting upgrades, consider blocking or rejecting Brotli from untrusted sources at the proxy/WAF layer (e.g., stripping
Content-Encoding: brfrom incoming requests); this is merely a risk-reduction measure and does not replace updating.
References
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
https://nodejs.org/en/blog/release/v26.12.1/
https://nodejs.org/en/blog/release/v24.22.1/
https://nodejs.org/en/blog/release/v22.23.4/
