Node.js Brotli Vulnerability CVE-2026-111497 Upgrade Guide

Node.js 22.x, 24.x, and 26.x are all affected by CVE-2026-111497. The fixed releases are 22.23.4, 24.22.1, and 26.12.1. The security risk arises when an application decompresses Brotli payload data supplied by an untrusted sender through the built-in node:zlib module.

On or shortly after Wednesday, October 21, 2026, the Node.js project released new versions of the 26.x, 24.x, and 22.x release lines to address security vulnerabilities. The details were published in the Node.js October 2026 Security Releases post, describing how malformed compressed input allows the Brotli decoder to write past the end of an internal buffer.

Which Node.js Versions Are Affected and What to Upgrade To

According to the Node.js October 2026 Security Releases post, Node.js 22.x, 24.x, and 26.x are all affected by CVE-2026-111497. The patched releases providing the fix are Node.js v22.23.4 for the 22.x branch, v24.22.1 for the 24.x branch, and v26.12.1 for the 26.x branch.

If your systems run unmaintained or End-of-Life Node.js releases, The Node.js project notes that End-of-Life branches remain affected by security defects disclosed in active releases, so organizations running retired releases must upgrade to an active, supported branch.

The official Node.js security release also incorporates patches for several additional security vulnerabilities fixed in the same release. Upgrading to the patched version resolves two high-severity Transport Layer Security (TLS) certificate hostname bypasses designated CVE-2026-105483 and CVE-2026-106069, a high-severity dns.resolve NUL-character truncation flaw registered as CVE-2026-105482, as well as multiple medium and low issues.

• Node.js 22.x: Upgrade any runtime older than v22.23.4 to v22.23.4 or later.
• Node.js 24.x: Upgrade any runtime older than v24.22.1 to v24.22.1 or later.
• Node.js 26.x: Upgrade any runtime older than v26.12.1 to v26.12.1 or later.
• End-of-Life branches: Migrate immediately to an active, maintained branch to apply the fix.

How to Identify Services That Decompress Untrusted Brotli

The vulnerable code path is Node's built-in zlib module Brotli decompression. Services face exposure when they process compressed input from external clients, third-party webhook publishers, or external APIs.

Within the core runtime, vulnerable operations include direct invocations of brotliDecompress, brotliDecompressSync, and streaming pipelines built with createBrotliDecompress. When untrusted data enters these methods, an invalid block switch is reported as a temporary need for more input instead of a permanent format error. The streaming decoder then appends input bytes to an eight-byte internal buffer. This out-of-bounds write can corrupt process memory, causing a crash, memory disclosure, or remote code execution.

Review your backend application codebases, integration services, and background workers for these common decompression scenarios:

• HTTP request bodies: Endpoints that accept compressed HTTP POST or PUT payloads with Content-Encoding set to br and decompress them using node:zlib before validation.
• File uploads and webhook receivers: Background jobs or API endpoints that ingest uploads and webhooks that carry .br data.
• Outbound HTTP clients: Proxy services or API aggregators that fetch responses with Content-Encoding: br from untrusted or user-specified external servers and decompress them through zlib.

Rebuilding and Redeploying Container Images

Updating a package dependency file or deployment manifest does not automatically update Node.js when your application runs inside a container image. Node.js is in the base image layer, meaning an application lockfile does not pin or update the runtime binary.

Container builds frequently reuse cached intermediate layers from local image storage or remote build registries. If your build pipeline invokes standard cache mechanisms, a Dockerfile specifying a broad base tag such as node:22 or node:24-alpine may continue packaging an unpatched Node.js binary until the local cache is discarded.

To confirm that the patched Node.js binary is running in your production environment, follow these deployment steps:

• Pin or update base tags: Bump the base image tag in your Dockerfile to a fixed release.
• Rebuild without cache: Execute the container build using flags that bypass layer caching, ensuring the build does not reuse a cached layer containing the old Node.js runtime.
• Check running versions: Execute node --version inside the active container in staging or production to confirm that the runtime reports the patched release number.

Research Credits and Severity Classifications

The Node.js October 2026 Security Releases post rates the highest severity issue in the release as High. The issue was reported by OpenAI Codex Security (Khai Tran and Sylvie Mayer) and fixed by mcollina and aduh95.

Third-party reports stated that OpenAI disclosed this finding on October 23, 2026, and that a national cyber agency rated it CVSS 9.8, though this is not confirmed by the primary source. The CVSS score from the Node.js project is unknown; readers should check the CVSS score in their own scanner or the NVD entry.

The standalone Brotli library is a separate project, and its versions are not covered in the Node.js post. Readers should check its release notes directly.

Mitigations and Factors That Change Upgrade Urgency

Organizations that decompress external or untrusted Brotli data with node:zlib must patch their Node.js installations immediately. When an application accepts compressed data from outside your perimeter, an attacker can deliver malformed streams to exploit the buffer overflow directly.

If you cannot upgrade immediately, note that temporary measures, such as rejecting inbound Content-Encoding: br requests at your edge or omitting br from outbound Accept-Encoding headers, only reduce exposure on those specific paths and do not replace upgrading the runtime.

The urgency of this maintenance depends on how your infrastructure uses Brotli decompression and on whether a public exploit appears. Three things set your priority:

• Data boundary: Applications that decompress user-supplied Brotli streams require immediate patching, otherwise patch in the normal window but still within days.
• Exploit availability: The Node.js project has not stated that active public exploitation exists. Urgency would change if a public exploit is published, if a confirmed Brotli library advisory is issued, or if your inventory shows no Brotli use.
• Code inventory: An audit of your own code and its dependencies that finds no node:zlib Brotli use supports a lower urgency, though it does not rule out exposure through a library.