Cybersecurity News Today: Node.js Brotli Decoder Flaw Can Allow RCE in Every Supported Version
The most urgent story in cybersecurity news today is a flaw inside the runtime that powers a large share of the web's servers and APIs. On October 21, 2026, Node.js shipped security releases for all three supported lines, fixing 10 flaws. The headline is CVE-2026-111497: an out-of-bounds write in the Brotli decompression code Node.js bundles, which the project says can allow remote code execution when an application decompresses Brotli data an attacker controls. Every supported line is affected — and Node 20.x and older, now end-of-life, get no fix at all. Run node -v, then use the checker below for a verdict and your exact upgrade target.
Honest scope — read this first: "Remote code execution" is the Node.js project's own description of what this flaw could allow, and the flaw is rated high, not critical. How far it has been shown in practice is narrower: a public proof of concept published October 22 reached code execution only against a deliberately weakened test build; on a standard Node.js build it produced a crash and a limited read of process memory, and its author said a working attack on a normal build was not achieved. No exploitation in the wild had been reported as of October 22, and patched builds reject the malformed input the proof of concept uses. None of that makes the fix optional: exposure needs only an app that decompresses attacker-controlled Brotli data, and the advisory offers no workaround — upgrading is the fix.
Update, October 22, 2026: the week's run of critical flaws widened again, this time to the Linux kernel. Trend Micro's Zero Day Initiative published two CVSS 9.0 remote code execution flaws in KSMBD, the SMB server built into the kernel, on public mailing lists before any fix existed, and neither has a CVE number yet. If your Node.js apps run on Linux file servers, work through the Linux KSMBD RCE check as well: there is no patch there, only exposure control.
The flaws, exactly as disclosed
CVE-2026-111497 — out-of-bounds write in the bundled Brotli decoder: the flaw is in code Node.js ships, not in your program. Node.js runs that decoder whenever it decompresses Brotli data — directly through the node:zlib module, or automatically when code calls fetch() on a response sent with Brotli compression. An application is exposed where it decompresses Brotli data an attacker controls: a request body, or a response fetched from another server. The fix is an upstream patch from the Brotli project that Node.js copied in, and it makes the decoder catch invalid input and stop earlier rather than writing past the buffer. Brotli itself shipped the same fix in 1.2.1, 1.1.1, and 1.0.10 on October 21, so other software that bundles Brotli may need the same update.
CVE-2026-106069 and CVE-2026-105483 — TLS hostname checks an attacker can bypass: both are rated high. Each lets a certificate match a host it should not when an IP address is written in an unusual form — a non-canonical form in one case, fullwidth digits in the other. Node.js rates CVE-2026-105483 high, though the commit that fixed it calls the bug low-severity and hard to exploit.
CVE-2026-105482 — DNS names cut short at a null byte: also rated high, it stops dns.resolve from truncating a hostname at an embedded null byte, which could make a lookup silently resolve a different name than the one the code asked for.
CVE-2026-105481 — a keep-alive socket can answer with a response written before the request: rated medium, on all three lines (22.x, 24.x, 26.x). A reused keep-alive connection could process a response that was written before the current request was even sent, pairing a request with data that does not belong to it.
CVE-2026-106072 — certificate validation for non-canonical IPv4 addresses: rated medium, on all three lines (22.x, 24.x, 26.x). When an address is written in a non-canonical IPv4 form, the certificate check could let a DNS name authenticate an IP endpoint it should not.
The three lows:CVE-2026-106070 (26.x only) — the ZipFile support can return attacker-controlled bytes after a header check has already failed. CVE-2026-106071 (26.x only) — the Permission Model over-grants file access through a wildcard lookup. CVE-2026-106073 (22.x, 24.x, 26.x) — the Permission Model can be bypassed through fs.realpathSync.
The eMudhra block rides along: the same releases stop Node.js from trusting the eight compromised eMudhra intermediate CA keys and remove three emSign roots. Node.js uses the Mozilla root list but does not perform revocation checks by default, so before this update a certificate chain built on one of the compromised keys still passed — the block had to ship in code. We track that incident on the eMudhra CA keys check.
HIGHseverity of CVE-2026-111497 — the project's RCE description, rated below the critical line
10flaws fixed in the October 21, 2026 releases across the 22.x, 24.x and 26.x lines
3fixed builds, one per supported line: 22.23.4 · 24.22.1 · 26.12.1
0workarounds offered for the Brotli flaw — upgrading is the only fix in the advisory
Put the scope in one sentence: the vulnerable decoder is bundled inside Node.js itself, so 100 percent of supported release lines — 22.x, 24.x, and 26.x — needed a patched build on the same day, and every line older than that is end-of-life and gets nothing.
Why this cybersecurity news today matters: the bug lives in the runtime, not your code
Most dependency scares live in a package somebody chose. This one lives in the runtime itself. Brotli is Google's compression library, and Node.js ships its own copy, so the flaw follows Node.js into every application built on it — including applications whose own code never touches compression directly, because fetch() decompresses Brotli responses automatically. The timeline deserves a look as well: the change was first made in Brotli's source in February 2026 and shipped as a security release only in October. Bundled code runs on its own patch clock, separate from yours — and nothing in your dependency list tells you it exists.
The rest of the set is not filler. The two TLS bypasses weaken the check that a certificate really belongs to the host you reached. A medium flaw, CVE-2026-106074, makes crypto.randomUUID() and crypto.randomInt() hand back the same values in every process when an application is built as a startup snapshot or a single-executable application — quietly undermining anything that relies on those values being unpredictable. The bundled undici, the HTTP client behind fetch(), moves to a version that fixes three moderate advisories, including two memory-exhaustion flaws, one of them in the WebSocket client built into Node.js. The releases also refresh the bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x.
If you cannot upgrade today, the options are thin and worth stating plainly. The advisory offers no temporary workaround for the Brotli flaw. Vercel, which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests — but those rules do not cover Brotli responses an application fetches from other servers, and they do not replace upgrading. Treat any firewall layer as time bought, not as the fix.
The fixes, line by line
Your line
Fixed in
Status
22.x (LTS), before 22.23.4
22.23.4
Update to 22.23.4 or later
24.x (LTS), before 24.22.1
24.22.1
Update to 24.22.1 or later
26.x (current), before 26.12.1
26.12.1
Update to 26.12.1 or later
20.x and earlier
—
End of life: no fix is coming. Move to a supported line
One operational detail decides whether the update actually protects you: the version that matters is the one answering production requests. Dockerfiles, CI images, serverless runtime settings, and hosting panels routinely pin a different Node.js than the one on your laptop — a dependency update alone does not change the Node.js binary your code runs on. Check every place the runtime is pinned, not just the first one you find.
Check your version — and your exposure — in under a minute
Type your Node.js version exactly as node -v reports it (a leading v is fine). Everything runs in your browser; nothing is sent anywhere.
Exposure check: the version verdict says whether a patch exists for you. These three answers say whether the Brotli flaw has a route into your application at all.
Run the Node.js check now
Find your real version, everywhere it runs:node -v on your machine is the start, not the answer. Check production next — Dockerfiles, CI images, serverless runtime settings, and your host's panel routinely pin a different version. The version that matters is the one answering requests.
Upgrade to your line's fixed build:22.23.4 / 24.22.1 / 26.12.1. On managed platforms, set the runtime version explicitly and redeploy; a dependency update alone does not change the Node.js binary your code runs on.
Know your exposure paths: if your app decompresses request bodies (uploads, webhooks, APIs accepting compressed payloads) or fetches external URLs, you are on the Brotli path — patch first, analyze second. Neither path requires your own code to import a compression library by name; fetch() decompresses on its own.
On Node 20.x or older: there is no patch coming, for this flaw or any future one. Plan the move to a supported line now — 22.x or 24.x — and budget the testing. End-of-life runtimes are where the next flaw will find you too.
If you cannot patch today: there is no configuration workaround inside Node.js. Host firewall rules — Vercel added inbound rules on October 21 — can block the request-body path, but they do not cover Brotli responses your application fetches from other servers. A shield for days, not a fix.
Take the rest of the release too: the same builds fix two TLS hostname-check bypasses, the dns.resolve null-byte flaw, and the randomUUID repetition in snapshot-built and single-executable apps — and they block the eight compromised eMudhra CA keys. Skipping the release because Brotli does not reach you still leaves those open.
Vibe-Code Audit — Ingenious AI's security audit for AI-built and fast-shipped applications — exists for exactly the gap this release exposes: apps generated quickly, runtimes and bundled libraries chosen by default, and nobody tracking which Node.js version production actually runs until a CVE names it. A vulnerable decoder hiding inside the runtime is the kind of finding a feature demo never shows you. Get early access on WhatsApp.
FROM INGENIOUS AI
Vibe-Code Audit is built for exactly this: auditing AI-built and fast-shipped apps for the runtime-version and bundled-dependency gaps nobody is tracking.
1. What does CVE-2026-111497 put at risk, per the Node.js project?
2. What did the public proof of concept achieve on a standard Node.js build?
3. Your production app runs Node 24.22.0. What is your status?
4. You still run Node 20.x. What does the October 21 release do for you?
5. Besides the 10 flaws, what did the same releases change about certificates?
Frequently asked questions
What is CVE-2026-111497, in plain terms?
CVE-2026-111497 is a high-severity flaw in the Brotli decoder that Node.js bundles inside itself. When an application decompresses Brotli data an attacker controls — a request body, or a compressed response it fetched — malformed input can write outside the intended memory. The Node.js project says that can allow remote code execution. It affects all three supported Node.js lines, and the fix is updating to the October 21, 2026 security releases.
Which Node.js versions are fixed, and which are affected?
The October 21, 2026 security releases fix all three supported lines: update 22.x to 22.23.4, 24.x to 24.22.1, and 26.x to 26.12.1 or later. Any earlier build on those lines is affected. Node 20.x and everything older are end-of-life: no fixed build exists and none is coming, so the only remedy is moving to a supported line and testing your application there.
How do I know if my application is exposed to the Brotli flaw?
Exposure needs your application to decompress Brotli data an attacker controls. The two paths are decompressing request bodies through node:zlib or a framework feature, and fetching URLs whose responses arrive Brotli-compressed, which fetch() decompresses automatically. If neither happens in your code, the decoder flaw has no obvious route in — but the same releases fix TLS, DNS, and certificate issues, so upgrading is still the right move.
Has CVE-2026-111497 been exploited, and how strong is the proof of concept?
As of October 22, 2026, no exploitation in the wild had been reported. A public proof of concept appeared the same week: it reached code execution only against a deliberately weakened test build, while a standard Node.js build crashed with a limited read of process memory, and its author said a working attack on a normal build was not achieved. Patched builds reject the malformed input it uses.
My app runs Node 20.x, or I cannot upgrade yet. What are my options?
Node 20.x and older are end-of-life: no fix exists and none is coming, so the real option is moving to a supported line — 22.x or 24.x — and testing there. If a supported-line upgrade must wait days, the advisory offers no workaround inside Node.js itself. Host firewall rules can block the inbound request path, but they do not cover responses your application fetches from other servers.
Sources: The Hacker News, October 2026 (the CVE-2026-111497 disclosure, the fixed versions, the proof-of-concept results, the other nine flaws, the eMudhra block, and the Vercel firewall note) · the Node.js project's October 21, 2026 security releases for the 22.x, 24.x, and 26.x lines, as reported in the coverage above · the Brotli project's 1.2.1 / 1.1.1 / 1.0.10 security releases, as reported in the same coverage.
Related checks
eMudhra CA Keys Check — the eight compromised CA keys the same Node.js releases now block