Node.js fixes a Brotli decoder RCE flaw across every supported release line

On October 21, 2026, Node.js shipped security updates for its three supported lines (22.x, 24.x, 26.x) fixing ten flaws, including an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497) that can lead to remote code execution. With no workaround offered, upgrading to 22.23.4, 24.22.1 or 26.12.1 is the only defense.