Overview
The Node.js project shipped security releases on October 21, 2026 for all three supported release lines, fixing 10 vulnerabilities. The most serious, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that the project says can allow remote code execution.
| Release line | Patched version |
|---|---|
| Node.js 22.x | 22.23.4 |
| Node.js 24.x | 24.22.1 |
| Node.js 26.x | 26.12.1 |
Of the ten CVEs, four are rated High, three Medium and three Low. No CVSS score has been published for the Brotli bug.
The Brotli Flaw
A specially crafted compressed stream that declares a single block type and then switches blocks is not rejected by the decoder, producing an out-of-bounds write. Malformed Brotli input is enough to trigger it.
Node.js reaches this code whenever it decompresses Brotli data:
- Directly through the
node:zlibmodule - Automatically when code calls
fetch()and the response uses Brotli compression - Through frameworks that decompress request bodies (one source reports Express 5 body parsing is exposed by default)
The same fix shipped upstream in Brotli 1.2.1, 1.1.1 and 1.0.10, so other software that bundles Brotli may also need updating. The change reportedly landed in Brotli's source in February 2026 and only became a security release in October.
Other High-Severity Fixes
| CVE | Issue |
|---|---|
| CVE-2026-105482 | dns.resolve truncates names containing a NUL character |
| CVE-2026-105483 | TLS certificate hostname bypass when an IP is written in fullwidth digits |
| CVE-2026-106069 | TLS certificate hostname bypass when the host loosely resolves to an IP address |
Recommended Actions
- Upgrade to 22.23.4, 24.22.1 or 26.12.1 and restart all Node.js processes
- Plan migrations off Node.js 20 and older, which receive no fix
- Rebuild container images and serverless bundles that pin a Node.js base image
- Check other Brotli consumers (proxies, CLI tools, bundled runtimes) for the upstream fix
- Interim workaround (reported by a third party, unverified): disable request body decompression, for example
inflate: falsein Express 5's body parser, until you can upgrade
The official advisory lists no workaround.