Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Node.js is not automatically exposed, but applications that decompress attacker-controlled Brotli data should be patched immediately. The Node.js Project disclosed CVE-2026-111497 on October 21, 2026. Malformed compressed input can make the Brotli decoder bundled with Node.js write beyond an internal buffer, potentially causing a crash, disclosure of process memory or remote code execution. OpenAI Codex Security researchers Khai Tran and Sylvie Mayer reported the flaw.
Exposure depends on whether an application actually reaches the vulnerable decoder with data an attacker can influence. A basic Node.js HTTP server does not decompress request bodies by itself.
As an Amazon Associate I earn from qualifying purchases.
What exactly is the Node.js Brotli vulnerability?
The Node.js Project describes CVE-2026-111497 as a flaw in its bundled Brotli decoder: “A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer.” An out-of-bounds write can corrupt process memory. Depending on how the process is arranged and what data is overwritten, consequences can include a denial-of-service crash, exposure of memory contents or code execution with the privileges of the Node.js process.
The issue is in decompression code, not in every HTTP connection or every compressed file. An attacker must get malicious Brotli data to a program path that decodes it.
Popular on Amazon
Am I affected if my Node.js application accepts compressed data?
You are potentially exposed when an untrusted party can supply Brotli bytes and your application, framework or dependency decompresses them. Check these common paths:
- Explicit use of
node:zlib: code calling Brotli decompression functions on uploads, messages or request bodies. - Automatic response decoding: a client using
fetch()may decode Brotli responses received from a server it does not fully trust. - Request middleware: an API or proxy that accepts a Brotli-encoded request body and decompresses it before parsing.
- Internal services: a supposedly private endpoint can still be risky if another tenant, compromised service or untrusted integration controls the compressed payload.
A plain Node.js HTTP server does not automatically decode incoming request bodies. Merely running Node.js, or serving ordinary uncompressed traffic, does not prove that the vulnerable code is reachable.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhich Node.js versions are vulnerable?
The Node.js advisory identifies the 22.x, 24.x and 26.x release lines as affected. The fixed releases are:
Also popular on Amazon
| Affected line | Fixed release |
|---|---|
| 22.x | 22.23.4 |
| 24.x | 24.22.1 |
| 26.x | 26.12.1 |
Node.js 20.x and earlier are end of life and do not receive this update. Move those deployments to a supported release line rather than treating an unsupported runtime as a long-term mitigation.
How should operators patch CVE-2026-111497?
- Inventory runtimes: record the Node.js version in production hosts, serverless images, worker processes and build containers. The command
node --versionshows the runtime in a shell. - Trace decompression: search application code and dependency configuration for Brotli handling,
node:zlib, request-body decompression and clients that accept compressed responses. - Upgrade: install 22.23.4, 24.22.1 or 26.12.1, or a later release that includes the fix. Update the base image and lockfile where applicable.
- Rebuild and redeploy: rebuilding an image is necessary if the old Node.js binary is baked into it. A package change on a build machine does not replace the decoder already loaded by a running process.
- Restart services: recycle workers, long-lived queues and application servers so they load the fixed decoder.
- Verify: check the running process version after deployment, not only the version used during the build, and confirm that all replicas were replaced.
The Node.js advisory lists no temporary workaround. If an upgrade is delayed, disable or avoid decoding untrusted Brotli data where your architecture allows it, isolate the decoder behind a tightly controlled boundary and reduce exposure. These steps reduce risk temporarily; they do not replace patching.
Why are severity ratings described differently?
Node.js calls the vulnerability high severity. A technical report published October 24, 2026 said Google assigned a CVSS 4.0 score of 9.2 and described it as critical. Those are different assessments from different sources. Report both with their attribution rather than presenting the Google score as Node.js’s own label.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Also popular on Amazon
The same October 24 report said no in-the-wild exploitation had been reported as of that date. That is a time-limited observation, not a promise that exploitation cannot begin later. Recheck current advisories, vendor notices and incident reports when making an operational decision.
Does the flaw affect software outside Node.js?
Yes. Projects often bundle their own Brotli implementation. The October 24 technical report identified Bun, Envoy, Istio and Python Brotli packages among potentially affected software. Their exposure depends on whether the product decodes attacker-controlled Brotli data and, in some cases, whether decompression is enabled by configuration.
Do not apply Node.js version numbers to those projects. Consult each project’s current advisory and fixed release. Google Brotli’s release page lists security releases 1.2.1, 1.1.1 and 1.0.10 for this CVE, all released October 21, 2026, but downstream products may ship those fixes on different schedules.
Also popular on Amazon
What should security teams check first?
- Identify internet-facing endpoints that accept compressed request bodies.
- Review reverse proxies and middleware for Brotli request decompression.
- Check outbound clients that automatically decode compressed responses from untrusted servers.
- Prioritize processes with high privileges, access to secrets or broad network reach.
- Confirm that patched binaries are running after every restart and container rollout.
- Preserve logs for unusual decompression errors, crashes or unexpected child-process activity while investigating.
The practical decision is reachability: determine whether an attacker can control bytes that the vulnerable decoder processes. A service with no Brotli decoding path is not made vulnerable merely by having Node.js installed, while a client or middleware that transparently decompresses untrusted content should be treated as exposed until updated.
Recommended Free Tools
Frequently Asked Questions
Can a malicious HTTP request exploit this if my API does not support Brotli?
Usually not through this specific path. If the server never invokes Brotli decompression and rejects or ignores compressed request bodies, the vulnerable decoder is not reached; verify that a proxy or framework layer is not decoding before your application sees the request.
Is upgrading Node.js enough for applications using a separate Brotli package?
Not necessarily. Separately bundled libraries have their own release versions and patch timelines, so check that package’s advisory and update it independently of the Node.js runtime.
Also popular on Amazon
Should I rotate secrets after patching?
Rotation is not automatically required by the advisory. Consider rotating credentials if you find evidence of memory disclosure, code execution, unexplained crashes or other compromise indicators; otherwise prioritize replacing vulnerable processes and reviewing logs.
Can a client be attacked by a server through compressed responses?
Yes, if the client accepts a Brotli response from an attacker-controlled or compromised server and decodes it. This is why outbound fetchers and command-line or service clients need review, not only servers receiving requests.
