Node.js Brotli Vulnerability Fix Guide

What is the Node.js Brotli vulnerability (CVE-2026-111497)?

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js. Malformed compressed input can corrupt process memory, which the Node.js project says can lead to a crash, memory disclosure or remote code execution. It is rated high and fixed in 22.23.4, 24.22.1 and 26.12.1 [1].

The cause is narrow: an invalid block switch was reported as a request for more input instead of a format error, so the streaming decoder kept appending bytes to an eight-byte internal buffer [1].

Is my app exposed to the Brotli flaw?

You are exposed where your code decompresses Brotli data an attacker controls. That includes node:zlib calls on request bodies, and fetch() on a response from another server sent with Brotli compression [1][2].

Fact: the advisory affects the 22.x, 24.x and 26.x lines. Node.js 20.x and earlier are end of life and get no fix [1][2].

Fact: a public proof-of-concept on 22 October reached code execution only against a deliberately weakened test build. On a standard build its author reported a crash and limited memory read, and no exploitation in the wild had been reported as of 22 October [2].

How do I check my Node.js version and upgrade?

1. Run node --version on every server, CI image and container. Compare it with the fixed releases: 22.23.4, 24.22.1 or 26.12.1.

2. Look beyond servers. Container images and single-file binaries that bundle Node.js will not show up in a package inventory [2].

3. Upgrade within your line, rebuild images, and redeploy. Node.js 20.x and earlier should move to a supported line [1][2].

4. Search your code for zlib.brotliDecompress, createBrotliDecompress and fetch calls to third-party hosts to see which paths touch Brotli data.

What if I cannot upgrade Node.js today?

The advisory offers no workaround inside Node.js, so there is no setting that turns the bug off [2]. Limiting untrusted Brotli traffic on affected paths helps where practical, but only the update removes the flaw [3].

Vercel said it added firewall rules on 21 October that block the attack in inbound requests. Those rules do not cover Brotli responses your app fetches from other servers, and do not replace upgrading [2].

What else changed in the October 2026 Node.js security release?

The same release fixes nine other issues, including three more rated high: a DNS resolve bug that truncates names at a NUL byte (CVE-2026-105482) and two TLS hostname-check bypasses for IPv4 hosts written in unusual forms (CVE-2026-105483, CVE-2026-106069) [1].

It also updates c-ares, OpenSSL, SQLite and undici, and, as The Hacker News reports, blocks eight eMudhra intermediate CA keys, the same block Go shipped on 20 October [2].

Our reading, not the project's: the TLS fixes matter more for services that connect to IP literals than for typical hostname-based SaaS traffic. Treat that as a prediction and check your own code paths.

Frequently asked questions

The short version

Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, rebuild any image that bundles Node, and prioritise services that decompress Brotli from untrusted sources. No workaround exists.

For the wider picture of patching a product's dependencies, see our guide to the Next.js and React security update, and our services page for how we scope SaaS builds.