Node.js fixes a Brotli decoder RCE flaw across every supported release line
On October 21, 2026, Node.js shipped security updates for its three supported lines (22.x, 24.x, 26.x) fixing ten flaws, including an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497) that can lead to remote code execution. With no workaround offered, upgrading to 22.23.4, 24.22.1 or 26.12.1 is the only defense.
October 21, 2026. Node.js ships security updates for its three supported release lines — 22.x, 24.x and 26.x — fixing ten flaws. October 21, 2026. The most serious is an out-of-bounds write in the Brotli decoder that Node.js bundles, which the project says can allow remote code execution (CVE-2026-111497). October 22, 2026. A public proof-of-concept only reached code execution against a deliberately weakened test build. Why it matters: the flaw lives in code Node.js ships, not in yours — it fires whenever your application decompresses attacker-controlled Brotli, including through a plain fetch().
An out-of-bounds write in code you never wrote
The Brotli flaw does not live in a user program: it lives in the copy of the Brotli compression library that Node.js bundles. Node.js runs that code whenever it decompresses Brotli data — either directly through the node:zlib module, or automatically when code calls fetch() on a response sent with Brotli compression.
In practice, an application is exposed whenever it decompresses Brotli whose content an attacker controls: a compressed request body, or a response fetched from another server. The defect is an out-of-bounds write in the decoder, triggered by malformed compressed input. The fix is an upstream patch from the Brotli project that Node.js copied in: the decoder now catches invalid input and stops earlier instead of writing past the buffer.
The same fix shipped in Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21. Any other software that bundles its own copy of Brotli — web servers, proxies, command-line tools — may therefore need the same update. The change was first made in Brotli’s source in February 2026, but only shipped as a security release in October.
The fixed versions are 22.23.4 and 24.22.1 on the LTS lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix: they must be moved to a supported line.
The gap between the label and the reality of exploitation
The project rates the flaw high, not critical, and that choice is backed up. A proof-of-concept published on October 22 reached code execution only against a deliberately weakened test build. On a standard Node.js build, its author reports a crash and a limited read of process memory, not code execution, and concludes that no working attack on a normal build was achieved.
Patched Node.js rejects the malformed input the proof-of-concept uses, and no in-the-wild exploitation had been reported as of October 22. That is not a reason to delay: an out-of-bounds write in a compression decoder is exactly the kind of bug that offensive research ripens into a working RCE within weeks, and the absence of any workaround removes all room for maneuver.
A concrete exposure scenario makes the risk tangible. Consider an API that calls fetch() on a partner endpoint and decompresses the response body through node:zlib without checking the content-encoding — the decompression happens automatically, in code you wrote years ago and never revisit. An attacker who controls the response, or who can inject a malicious payload into a request body, reaches the vulnerable decoder without ever touching your application logic. The fix sits entirely in the runtime, which is why a version bump — not a code review — is the actual remediation.
The other nine flaws, and two you should not overlook
The ten fixes are not limited to Brotli. Three more are rated high. Two are TLS certificate hostname bypasses: an attacker can write a server’s IP address in an unusual form so a certificate matches a host it should not — fullwidth digits for CVE-2026-105483, a loosely-resolved host-to-IP for CVE-2026-106069. The third stops dns.resolve from truncating a hostname at an embedded null byte (CVE-2026-105482).
The sneakiest medium flaw is CVE-2026-106074: crypto.randomUUID() and crypto.randomInt() return the same values in every process when an application is built as a startup snapshot or a single-executable application (SEA). Anything that depends on those values being unpredictable — tokens, session identifiers, nonces — becomes deterministic. Two low fixes concern the permission model: a filesystem over-grant via a wildcard radix lookup (CVE-2026-106071) and a bypass via fs.realpathSync (CVE-2026-106073).
The update also refreshes several bundled parts: the undici copy, the HTTP client behind fetch(), absorbs three moderate advisories; c-ares, OpenSSL (on 22.x and 24.x) and SQLite (on 22.x) receive fixes for publicly known vulnerabilities.
The eMudhra key block shipped in the same update
The same versions stop trusting the eight intermediate CA keys from the Indian authority eMudhra that were reported compromised days earlier. Node.js uses the Mozilla root list but does not perform revocation checks by default: before this update, a certificate chain built on one of those compromised keys still passed. The update adds a built-in block on the eight keys and removes three emSign roots from the bundled list; Go made the same block in its own update on October 20.
The link to our analysis of eMudhra’s exit from the TLS certificate market is direct: the compromise of a certificate authority propagates into runtimes before most administrators have even seen the alert. A connection resumed from a session that began before the update is not re-checked until that session times out, and end-of-life lines do not receive the block.
What the update says about your bundled dependencies
The Brotli flaw exposes a classic blind spot in vulnerability tracking: you audit your application dependencies, but not the native libraries a runtime compiles and ships silently. Node.js bundles its own copy of Brotli, undici, OpenSSL, c-ares and SQLite — and each carries its own history of flaws. A CVE in any one of them propagates to every Node.js program, even those whose code has not changed in years.
The fix requires no change to your code: it is a runtime update, not an API migration. But that is exactly what makes it easy to postpone — a minor Node.js version bump is often treated as routine maintenance, when here it carries an RCE fix. Teams that pin versions or wait for the next maintenance window take an unnecessary risk on a flaw with no workaround.
For auditing, two reflexes suffice. First, inventory your versions: node -v on every service, and flag anything still on 20.x or earlier. Second, widen the search to anything that bundles Brotli outside Node.js — proxies, web servers and tools that do their own decompression must apply the Brotli 1.2.1, 1.1.1 and 1.0.10 fixes. A decompression flaw does not respect your language boundaries: it crosses everything that accepts malformed Brotli on input.
Verdict
Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 without waiting. The Brotli flaw has no reliable in-the-wild exploit yet, but it has no workaround: an application that cannot migrate immediately has no internal fallback, and the two TLS bypasses plus the entropy cache of CVE-2026-106074 are exploitable today on common configurations. If you run Node.js 20.x or earlier, plan the migration to a supported line: you get neither the Brotli fix nor the eMudhra block. If you operate a platform that runs Node.js for customers, follow Vercel’s lead: firewall rules applied on October 21 block the attack on inbound requests, but they do not cover Brotli responses fetched from other servers and do not replace upgrading. Compression is no longer an optimization detail — it is an attack surface, and it is patched by moving to a new version.