Node.js Patches Brotli Decoder Flaw That Permits Remote Code Execution

The Node.js project released security updates on 21 October 2026 that fix a flaw in the Brotli decompression code bundled with Node.js. The advisory, CVE-2026-111497, describes an out-of-bounds write in the Brotli decoder that it says permits remote code execution. The Hacker News says the flaw is set off by malformed compressed input. A public proof-of-concept was published on 22 October 2026.

The Node.js project rates the flaw high severity and lists it for the 22.x, 24.x and 26.x lines. Brotli is Google’s compression library, and Node.js ships its own copy of it. Node.js 20.x and earlier have reached end of life and will not receive the fix. According to The Hacker News, the advisory offers no temporary workaround.

Patched Versions and Who Reported the Bug

The fixed releases are 22.23.4 and 24.22.1 for the long-term support lines and 26.12.1 for the current line, according to the Node.js advisory and The Hacker News. The Node.js release table lists 22.x and 24.x as LTS and 26.x as Current. The advisory credits mcollina with the report and aduh95 with the fix.

The release addresses ten flaws in all, including the Brotli bug. Two of them are TLS certificate hostname bypasses that the advisory also rates high. The release also covers a DNS name truncation bug, a certificate validation issue for non-canonical IPv4 hostnames, and several medium and low items in the Permission Model and crypto modules.

The Hacker News reports that the fixing commit for CVE-2026-105483 calls that bug low-severity and hard to exploit, while the advisory rates it High.

The release also updates bundled certificate data. According to The Hacker News, Node.js now stops trusting eight intermediate certificate authority keys from the Indian provider eMudhra, which were reported compromised days earlier. Node.js uses the Mozilla root list but does not perform revocation checks by default, so a chain built on one of the compromised keys had passed before the update. The article says the Go language issued the same block on October 20.

The Patched Versions
Node.js released the fixes on 21 October 2026. The fixed versions are 22.23.4 and 24.22.1 for the LTS lines and 26.12.1 for the current line.

How the Brotli Flaw Is Reached

Node.js runs its Brotli code when it decompresses Brotli data. That happens either directly through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression. Applications are exposed when they decompress Brotli data an attacker controls, such as a request body or a response fetched from another server.

The upstream fix comes from the Brotli project. It makes the decoder reject invalid input and stop before writing past the buffer, according to The Hacker News. The same fix shipped in Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21, and other software that bundles Brotli may need the same update. The change first appeared in Brotli’s source in February 2026 and was released as a security update only in October.

A public proof-of-concept published on October 22 reached code execution only on a deliberately weakened test build. On a standard build, its author reported a crash and a limited memory read. According to The Hacker News, the patched Node.js rejects the malformed input the proof-of-concept uses, and no in-the-wild exploitation had been reported as of October 22.

Vercel said it added firewall rules on October 21 that block the attack in inbound requests. Those rules do not cover Brotli responses that an application fetches from other servers, and they do not replace upgrading. A Node service that decompresses Brotli responses from other servers is therefore not covered by those rules.

Node.js 20.x and Earlier Get No Patch

The Node.js release page lists Node.js 20.x as end of life, with a ‘Last updated’ date of March 24, 2026. The Hacker News says those lines will not receive the Brotli fix and should be moved to a supported release line. The eMudhra certificate block also does not reach end-of-life lines, according to the same article.

The Node.js advisory says end-of-life versions are affected whenever a security release ships. It also says commercial support for versions past Maintenance LTS is available through OpenJS Ecosystem Sustainability Program partners.

The release page says production applications should use only Active LTS or Maintenance LTS releases. It lists 22.x and 24.x as LTS and 26.x as Current.

Upgrading is the fix.

What Teams Should Patch First

Start with any service running Node.js 20.x or earlier, since it has no fix and needs a move to 22.x, 24.x or 26.x. Next, upgrade Node services on the supported lines to 22.23.4, 24.22.1 or 26.12.1.

Then check tools that bundle their own Brotli copy. No workaround has been announced, so an application that cannot upgrade immediately has no fallback within Node.js itself, according to The Hacker News. Vercel’s statement that its rules do not replace upgrading points the same way. Upgrading is the fix, according to The Hacker News.