Node.js CVE-2026-111497 (Brotli): update to 22.23.4

On 21 October 2026, Node.js published updates for the 22.x, 24.x and 26.x lines. Among the ten vulnerabilities fixed, the project rates CVE-2026-111497 as High: the bundled Brotli decoder writes past an internal buffer when it receives malformed data. Concretely, an invalid block switch was reported as a mere need for more input rather than a permanent format error. The streaming decoder then kept appending bytes to an eight-byte internal buffer. The possible consequences range from a process crash to memory disclosure and remote code execution with the privileges of the Node process.

On severity, two readings coexist. Node.js says High; Google, as CVE numbering authority, assigns a CVSS v4 score of 9.2, according to Rapid7's analysis. As of 26 October 2026, Rapid7 is not aware of any exploitation in the wild, and the flaw is not in the CISA Known Exploited Vulnerabilities catalog. The flaw is therefore not exploited so far, according to Rapid7: this is a window to patch calmly, not a reason to wait.

Running a vulnerable Node is not enough to be attackable. The Node.js advisory targets an application that decompresses attacker-supplied Brotli data with node:zlib, through zlib.createBrotliDecompress or zlib.brotliDecompress. Rapid7 points out that the mere presence of the decoder does not establish exposure: everything depends on what the application decompresses. Do not conclude too quickly that there is no risk, though, because Brotli often goes through libraries you did not write.

The link with the Content-Encoding: br header is our reading, not a statement from the advisory. In the public source code, the fetch built into Node (undici) decodes br responses with zlib.createBrotliDecompress, the axios HTTP adapter provides the same decoding, and the current body-parser code does the same for incoming request bodies. Two flows therefore need review: what your application receives from clients, and what it fetches from third-party servers. You can check this in your own dependency tree, with the inventory commands below.

A fleet of client sites with mixed versions and installations cannot be updated in one move, and it does not need to be. Start with the Internet-facing servers that receive compressed bodies or call third-party services: server-side rendering, gateways, proxies, public APIs. Internal applications and workers come next, then build tooling. Applications on Node 20 are a separate case: no fix will ever exist for them, and the only way out is migrating to 22.x or 24.x, which is better planned with the client than improvised. Work in stages of a few machines, and verify each stage before moving to the next.

Node.js has published no workaround: the only vendor mitigation is the fixed version. Failing that, Rapid7 recommends restricting or disabling the application paths that decompress untrusted Brotli. Here is what that looks like in practice. The following points are risk-reduction measures we suggest, not vendor recommendations, and none replaces the fix.

On incoming requests, refuse Brotli at the reverse proxy level, for example in nginx: if ($http_content_encoding ~* br) { return 415; }. Test with nginx -t before reloading, and check that none of your legitimate clients sends br bodies. For responses from third parties, advertise only the useful encodings with the Accept-Encoding: gzip header, and limit the destinations your outgoing calls may reach. That last measure is partial: a malicious server can answer with br even if it was not requested, and the decoder follows the response header. On Vercel, WAF rules block the inbound flow but not the responses your functions fetch; redeploying with a fixed version is still necessary.

The same release fixes nine other flaws. They include two high-severity TLS hostname verification bypasses, CVE-2026-105483 and CVE-2026-106069, as well as CVE-2026-105482, a truncation of hostnames containing a NUL character in DNS resolution, also rated High. They do not all affect the same lines: CVE-2026-105483 concerns the 26.x and 24.x lines, while the other two also concern 22.x. An application that validates TLS certificates for its outgoing calls therefore has good reasons to move to the fixed version without waiting to settle the Brotli question.

When you carry dozens of sites, the update command takes a minute; the time goes elsewhere. You have to find which machine runs which version for which client, then obtain a restart window. Keep a living register, fed by the inventory above: at the next flaw, a simple filter on the Node line gives the list of sites to handle. The fewer variants in the fleet, the fewer cases to handle by hand, and reseller hosting follows that logic: a single interface for the portfolio and grouped renewals, whereas a collection of disparate servers multiplies the accesses to track. Applications stuck on Node 20 need separate handling: the migration guide linked below this article spares you from discovering the absence of a fix on the day of the next flaw.

Node.js security advisory of October 2026: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Rapid7 analysis of CVE-2026-111497: https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/

Vercel bulletin: https://vercel.com/kb/bulletin/node-js-security-advisory

zlib module documentation: https://nodejs.org/api/zlib.html

nvm documentation: https://github.com/nvm-sh/nvm

Updating pm2: https://pm2.keymetrics.io/docs/usage/update-pm2/

docker build options: https://docs.docker.com/reference/cli/docker/buildx/build/