Node.js October 2026 security release: CVE-2026-111497 in Brotli and nine more flaws
On 21 October 2026 Node.js fixed ten vulnerabilities, four of them high severity; the most serious allows code execution through malformed Brotli data. Fixed versions, exposed surface and verification.
On 21 October 2026 the Node.js project released security updates for its three supported lines: 22.23.4, 24.22.1 and 26.12.1. They fix ten vulnerabilities, four of them high severity. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js that can leak process memory or execute code. This article defines which applications process Brotli data without knowing it, orders the update by environment and proposes a per-server verification.
The official advisory documents no workarounds: the fix is to update.
An explanation for readers who do not run servers
Node.js is the environment that runs JavaScript on the server. APIs, online stores, internal dashboards and sites built with Next.js, Nuxt or Express rely on it. Brotli is a compression format that shrinks what travels over the network; Node.js decompresses it automatically in several places.
The flaw lets maliciously crafted compressed content make the server write outside the memory area it owns. Researchers showed this is enough to read process memory or run commands with the same permissions. For a business, the useful question to the team or provider is: "Which Node.js version do our services run, and when were they last redeployed?"
The ten vulnerabilities of 21 October
| CVE | Severity | Official description, summarised |
|---|---|---|
| CVE-2026-111497 | High | Out-of-bounds write in the Brotli decoder; remote code execution |
| CVE-2026-105483 | High | TLS certificate hostname bypass when the IP is written in fullwidth digits (24.x and 26.x) |
| CVE-2026-106069 | High | TLS hostname bypass when the host loosely resolves to an IP address |
| CVE-2026-105482 | High | dns.resolve truncates names containing a NUL character |
| CVE-2026-105481 | Medium | Keep-alive socket processes a response written before the request was sent |
| CVE-2026-106072 | Medium | Improper certificate validation for non-canonical IPv4 hostnames |
| CVE-2026-106074 | Medium | crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and SEAs |
| CVE-2026-106070 | Low | ZipFile returns attacker-controlled bytes after failed ZIP header validation (26.x) |
| CVE-2026-106071 | Low | Permission Model over-grant via wildcard lookup (26.x) |
| CVE-2026-106073 | Low | Permission Model bypass with fs.realpathSync |
The release also updates internal dependencies: c-ares, Undici, OpenSSL (22.x and 24.x), SQLite (22.x) and the root certificate store, which removes trust in eMudhra's compromised intermediates.
Surface exposed to CVE-2026-111497
According to Vercel's bulletin, exposure exists when the application, or a library it uses, decompresses Brotli data controlled by a third party, whether in an incoming request body or in a response the server fetches. The second path is the less obvious one: a service that calls external APIs with fetch() receives responses that are decompressed according to the Content-Encoding header.
The distinction matters for defence. A web application firewall (WAF) inspects incoming traffic, not the responses the server obtains from other sites. That is why Vercel, despite deploying WAF rules, recommends updating every Node.js runtime it does not manage, including external backends, self-built containers, CI runners and developer machines.
Fixed versions and unsupported lines
- Node.js 26.x: 26.12.1.
- Node.js 24.x: 24.22.1.
- Node.js 22.x: 22.23.4.
- Node.js 20.x and 25.x: end of life, no fix. The project notes that unsupported versions are always affected by each security release.
Updating by environment
- Servers using nvm, official binaries or NodeSource packages: install the fixed version and restart every process (pm2, systemd, Docker). A running process keeps the old binary.
- Containers: rebuild on a fixed base image, for example a freshly pulled
node:24, and redeploy. Images already built do not change on their own. - Managed platforms: confirm the applied version with the provider. On Vercel, projects on Node.js 20.x must move to 22.x or 24.x and redeploy.
- Linux distributions and CloudLinux: apply the vendor package and confirm in its advisory that it includes CVE-2026-111497.
- Startup snapshots and SEA executables: as a design rule, regenerate them with the fixed version, because CVE-2026-106074 describes entropy values stored inside the generated artefact.
Verification procedure
- Inventory services, functions, containers and CI runners that use Node.js, including copies bundled with third-party tools.
- Obtain the running version, not the installed one:
node -p process.versioninside the service's container or environment, or a startup log that prints it. - Compare it with 22.23.4, 24.22.1 or 26.12.1, depending on the line.
- Confirm the date of each service's last deployment or restart.
- For services that call external APIs, check whether any dependency pins its own Node.js version, such as old base images in a
Dockerfileor theenginesfield inpackage.json.
Frequently asked questions
My application does not use Brotli explicitly. Am I exposed?
Possibly. Decompression happens inside fetch(), middleware and HTTP libraries without the code asking for it. The safe way to rule it out is to update.
Is Next.js related to this flaw?
Next.js runs on Node.js, so it inherits the runtime's exposure. Separately, on 14 October Next.js released its own fixes for the 15.5.x and 16.x lines, which are worth applying in the same cycle.
Sources
- Node.js, October 2026 Security Releases.
- Vercel, bulletin on CVE-2026-111497.
- CloudLinux, alt-nodejs updates.
Support updating Node.js
Xterra Engine reviews Node.js service inventories, prepares image and deployment updates, and migrates applications still on unsupported lines. To request support or a quote, write to info@xterraengine.com or use the contact form.