Node.js patches Brotli decoder RCE across all supported lines

Node.js released security updates on 21 October 2026 for all three supported release lines, fixing 10 vulnerabilities. The one to act on is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles, rated High and described by the project as permitting remote code execution. The official October 2026 security releases post is the primary source.

Fixed versions

Node.js 20.x and earlier are end of life and receive no fix. There is no workaround for the Brotli flaw — upgrading is the remediation.

What the Brotli bug does

CVE-2026-111497 is an out-of-bounds write in the bundled Brotli decompression code, set off by malformed compressed input. Any Node.js path that decompresses attacker-controlled Brotli data — an HTTP server reading a br-encoded request body, or a client decompressing a Brotli response from a remote server — can reach it. The fix is an upstream Brotli patch that rejects invalid input earlier.

Exploitation status

No in-the-wild exploitation had been reported as of 22 October. A public proof-of-concept appeared on 22 October, but The Hacker News reports it reached code execution only against a deliberately weakened test build; on a standard build its author saw a crash and a limited read of process memory. That lowers the immediate panic but does not make the flaw safe to leave unpatched — memory-corruption primitives tend to get sharper with time.

The other nine

Three more are rated High and worth noting alongside the RCE:

• CVE-2026-105482 — dns.resolve truncates names containing a NUL character.
• CVE-2026-105483 — TLS certificate hostname bypass when an IP is written with fullwidth digits.
• CVE-2026-106069 — TLS certificate hostname bypass when the host loosely resolves to an IP address.

The remainder are Medium (keep-alive response desync, non-canonical IPv4 SAN matching, entropy-cache reuse in snapshots/SEAs) and Low (Permission Model bypasses, a ZIP header-validation leak). The release also refreshes bundled dependencies — c-ares, OpenSSL, SQLite, Undici — and updates the trusted-CA store to drop the compromised eMudhra intermediate, which we covered separately.

Action checklist

1. Upgrade to 22.23.4 / 24.22.1 / 26.12.1 on the matching line, prioritising any service that decompresses Brotli input it doesn't control.
2. If you're on 20.x or older, this is a forced migration — no patch is coming.
3. Rebuild and redeploy container images pinned to an older Node base; a node:22-style tag won't pick up the fix until you repull and rebuild.
4. For the two TLS hostname-bypass bugs, treat any service relying on certificate hostname validation (mTLS, SSRF guards keyed on hostnames) as exposed until upgraded.

Context

A bundled-decompressor RCE that hits every supported line is a reminder that the runtime's attack surface includes the C libraries it ships, not just your application code. Node's June 2026 release fixed 12 CVEs across the same three lines; four months later it's another full-line sweep. If your deploy pipeline can't roll a Node patch inside a day, that lag is now the exposure.