Node.js Patches High-Severity Brotli RCE Flaw (CVSS 9.2) Among 10 CVEs

The Node.js project released security updates for all three of its active release lines on Wednesday, 21 October 2026, patching ten vulnerabilities, four of them rated high severity. The headline fix closes a high-severity out-of-bounds write in Node's bundled Brotli decoder, tracked as CVE-2026-111497, which the Node.js project's advisory describes as permitting remote code execution. The patched releases are v26.12.1, v24.22.1 and v22.23.4; the advisory notes that end-of-life release lines, which include Node.js 20.x, are always affected by a security release but do not receive a fix.

The flaw sits in code every Node.js application can reach without realizing it. Node's built-in fetch() decompresses responses sent with a Content-Encoding: br header by default, and the node:zlib module exposes the same decoder directly. A security writeup from Strix scores CVE-2026-111497 at 9.2 out of 10 on the CVSS 4.0 scale — within the "critical" band of that scoring system even though Node.js's own advisory lists the issue as "high" — and classifies it under CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value), describing the bug as a buffer overflow that lets a remote, unauthenticated attacker "corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream."

For students and developers, the practical lesson is less about Node.js itself and more about where the bug actually lives. The decoder is vendored C++ code from Google's Brotli library, not something the Node.js core team wrote. Strix's writeup places the vulnerable range at Brotli versions 1.0.3 up to but not including 1.0.10, 1.1.0 up to 1.1.1, and 1.2.0 up to 1.2.1 — Node.js inherited the bug by bundling an older copy of that library, the same pattern that has repeatedly turned compression and parsing libraries into a soft underbelly of otherwise well-maintained runtimes.

Independent security coverage reached the same conclusion about exposure. A writeup from Astra Security lists CVE-2026-111497 as the headline issue of the release and places the attack surface at any application that decompresses attacker-controlled Brotli data, including HTTP requests carrying a Content-Encoding: br header and WebSocket frames using Brotli compression. That framing matters for anyone running a Node.js-based API, since a server does not need to call any unusual function to be exposed — ordinary request-body parsing is enough if Brotli decompression is enabled.

The other nine fixes in the same release

The release bundles several lower-profile but still notable issues, according to the Node.js advisory:

The three TLS-related entries are worth pausing on for anyone studying network security: each describes a different way a certificate's hostname check can be tricked into matching an IP address it should not match, whether through fullwidth Unicode digits or loose hostname-to-IP resolution. Taken together with the Brotli flaw, the release is a reminder that runtime security bugs cluster around the places where untrusted input meets parsing code — compression streams, certificate strings, DNS responses — rather than around application logic.

What to do, and why the deadline is now

The Node.js advisory also lists a dependency update addressing a compromised eMudhra intermediate certificate authority as part of the same release, alongside updates to c-ares, OpenSSL, SQLite and Undici — a reminder that a runtime's dependency tree, not just its own code, is part of what a security release has to cover. None of that changes the urgency of the headline fix: because the Brotli decoder runs as native code inside the Node.js process, a successful exploit is not limited by JavaScript's own memory safety guarantees.

For anyone running a Node.js service in production, the advisory's instruction is unambiguous: update to v26.12.1, v24.22.1 or v22.23.4 depending on which line is in use, and audit whether any code path decompresses Brotli data from an untrusted source in the meantime. Projects still on Node.js 20.x or earlier receive no patch and should treat migration to a supported line as the only fix available.