[{"data":1,"prerenderedAt":210},["ShallowReactive",2],{"seo-verification":3,"blog-node-js-cve-2026-111497-brotli-update-to-22-23-4-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-node-js-cve-2026-111497-brotli-update-to-22-23-4-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":151,"ctaBody":152,"ctaButton":153,"ctaUrl":154,"relatedPosts":155},510,"node-js-cve-2026-111497-brotli-update-to-22-23-4",{"fr":12,"en":10,"ar":13,"es":14},"nodejs-brotli-cve-2026-111497-mettre-a-jour","ثغرة-node-js-cve-2026-111497-brotli-التحديث-إلى-22-23-4","node-js-cve-2026-111497-brotli-actualizar-a-22-23-4","Node.js CVE-2026-111497 (Brotli): update to 22.23.4","Node.js 22.23.4, 24.22.1 and 26.12.1 fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Exposure check, fleet inventory, updates, mitigations.",10,0,false,"2026-10-27T00:00:00+00:00","2026-10-27T23:58:39+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fnodejs-brotli-cve-2026-111497-mettre-a-jour-poster.svg","On 21 October 2026, Node.js released versions 22.23.4, 24.22.1 and 26.12.1 to fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder that can lead to remote code execution. On a fleet of sites running Next, Nuxt or Express, \"just update\" is not a full answer: you need to know which applications actually decompress untrusted Brotli, which processes still run the old binary, and what to do with an application stuck on Node 20. This guide gives the commands to inventory, fix and verify, then to reduce the risk when the fix has to wait.",[35,39,75,78,89,114,117,135,139,142,145,148],{"type":36,"title":37,"body":38},"h2","What the October 2026 Node.js release fixes","On 21 October 2026, Node.js published updates for the 22.x, 24.x and 26.x lines. Among the ten vulnerabilities fixed, the project rates CVE-2026-111497 as High: the bundled Brotli decoder writes past an internal buffer when it receives malformed data. Concretely, an invalid block switch was reported as a mere need for more input rather than a permanent format error. The streaming decoder then kept appending bytes to an eight-byte internal buffer. The possible consequences range from a process crash to memory disclosure and remote code execution with the privileges of the Node process.\n\nOn severity, two readings coexist. Node.js says High; Google, as CVE numbering authority, assigns a CVSS v4 score of 9.2, according to Rapid7's analysis. As of 26 October 2026, Rapid7 is not aware of any exploitation in the wild, and the flaw is not in the CISA Known Exploited Vulnerabilities catalog. The flaw is therefore not exploited so far, according to Rapid7: this is a window to patch calmly, not a reason to wait.",{"type":40,"title":41,"headers":42,"rows":46},"comparison","Affected versions and fixed versions",[43,44,45],"Case","Status","Action",[47,51,55,59,63,67,71],[48,49,50],"Node.js 22.x","Affected before 22.23.4","Move to 22.23.4",[52,53,54],"Node.js 24.x","Affected before 24.22.1","Move to 24.22.1",[56,57,58],"Node.js 26.x","Affected before 26.12.1","Move to 26.12.1",[60,61,62],"Node.js 20.x and other end-of-life lines","Treat as affected, no fix available","Migrate to 22.x or 24.x",[64,65,66],"Docker image node:\u003Cline>","Affected until the image is rebuilt","Rebuild with --pull --no-cache",[68,69,70],"Node binary bundled in a tool (Electron, packaged executable)","Depends on the embedded version","Update the tool itself",[72,73,74],"Other software that embeds the same Brotli decoder","Depends on the vendor","Read its own advisory",{"type":36,"title":76,"body":77},"Are you exposed: the deciding criterion","Running a vulnerable Node is not enough to be attackable. The Node.js advisory targets an application that decompresses attacker-supplied Brotli data with `node:zlib`, through `zlib.createBrotliDecompress` or `zlib.brotliDecompress`. Rapid7 points out that the mere presence of the decoder does not establish exposure: everything depends on what the application decompresses. Do not conclude too quickly that there is no risk, though, because Brotli often goes through libraries you did not write.\n\nThe link with the `Content-Encoding: br` header is our reading, not a statement from the advisory. In the public source code, the `fetch` built into Node (undici) decodes `br` responses with `zlib.createBrotliDecompress`, the axios HTTP adapter provides the same decoding, and the current body-parser code does the same for incoming request bodies. Two flows therefore need review: what your application receives from clients, and what it fetches from third-party servers. You can check this in your own dependency tree, with the inventory commands below.",{"type":79,"title":80,"items":81},"ul","Where untrusted Brotli can enter a Node application",[82,83,84,85,86,87,88],"**Compressed incoming requests** — an Express API or a custom server that uses body-parser decompresses a `Content-Encoding: br` body sent by any client.","**Responses from third-party services** — `fetch` or axios calling an API, an RSS feed, a webhook or a page to preview: the remote server chooses the encoding of the response.","**Server-side rendering** — a Next or Nuxt application that fetches remote data during rendering goes through those same outgoing calls.","**Proxies and gateways written in Node** — a component that decompresses to inspect or transform content in transit opens both flows at once.","**File processing** — a service that accepts Brotli-compressed files or archives and opens them with `zlib.brotliDecompress`.","**Build and CI tooling** — deployment scripts and jobs that download artifacts: less exposed, but they use the same binary and get patched at the same time.","**No path identified** — lower priority, not zero: a dependency added later is enough to create exposure, and the release also fixes other flaws.",{"type":90,"title":91,"steps":92},"steps","Inventory your fleet in fifteen minutes",[93,96,99,102,105,108,111],{"title":94,"body":95},"Read the version on each machine","`node -v`\n`which -a node`\nSeveral binaries often coexist: the system one, the nvm one, one inside a container. `which -a` lists them all, and the first is not always the one the service uses.",{"title":97,"body":98},"Find the real binary of each process","`ps -eo pid,user,args | grep -E '[n]ode|[p]m2'`\n`sudo readlink -f \u002Fproc\u002F\u003Cpid>\u002Fexe`\nThe second command, run with the PID you found, gives the exact path of the binary running the process. It is the only reliable answer on a machine that carries several Node installations.",{"title":100,"body":101},"Query the containers","`docker ps`\n`docker exec \u003Cconteneur> node -v`\n`docker images | grep node`\nA running container does not fix itself: it keeps the image it started with, even if a newer image exists on the machine.",{"title":103,"body":104},"Search your code for direct calls","`grep -rEn \"createBrotliDecompress|brotliDecompress\" --include=*.js --include=*.mjs --include=*.ts . --exclude-dir=node_modules`\nEach line found is a point where your code decompresses Brotli. Look at where the data comes from: a file you produced yourself carries a different risk than a request body.",{"title":106,"body":107},"Search for libraries that decompress on your behalf","`grep -rlE \"createBrotliDecompress\" node_modules --include=*.js`\n`npm ls body-parser axios undici`\nThe first command lists installed packages that call the decoder; the second shows which versions of body-parser, axios and undici are present in the project. Run them in every repository, not only the most recent one.",{"title":109,"body":110},"Spot bundled binaries","Tools that ship their own Node (Electron applications, packaged executables) are not covered by `apt`. Look up their version in their documentation and check whether the vendor has released a fixed version.",{"title":112,"body":113},"Record the result in a table","One row per process: machine, client, Node line, version, Brotli path identified or not. This table decides the order of work, and it will serve as proof once the update is done.",{"type":36,"title":115,"body":116},"In which order to handle the fleet","A fleet of client sites with mixed versions and installations cannot be updated in one move, and it does not need to be. Start with the Internet-facing servers that receive compressed bodies or call third-party services: server-side rendering, gateways, proxies, public APIs. Internal applications and workers come next, then build tooling. Applications on Node 20 are a separate case: no fix will ever exist for them, and the only way out is migrating to 22.x or 24.x, which is better planned with the client than improvised. Work in stages of a few machines, and verify each stage before moving to the next.",{"type":90,"title":118,"steps":119},"Update according to the installation method",[120,123,126,129,132],{"title":121,"body":122},"apt package (NodeSource repository or distribution)","`apt-cache policy nodejs`\n`sudo apt-get update`\n`sudo apt-get install --only-upgrade nodejs`\n`node -v`\nFirst read the source displayed by `apt-cache policy`: the repository must point to the right line (node_22.x or node_24.x). A repository left on an end-of-life line will never offer the fix. A distribution package may also carry a different number: compare with your distribution's advisory.",{"title":124,"body":125},"nvm","`nvm install --reinstall-packages-from=current 22`\n`nvm alias default 22`\n`nvm use 22`\n`node -v`\nThe command installs the latest 22.x available; check that `node -v` shows 22.23.4 or higher. Do the same with 24 if that is your line. Services started by another user have their own nvm.",{"title":127,"body":128},"Docker","Change the tag on the `FROM` line, for example `FROM node:22` or `FROM node:24` with the variant you already use, then:\n`docker build --pull --no-cache -t monapp:corrige .`\n`docker compose up -d`\nThe `--pull` option fetches the latest base image, `--no-cache` avoids reusing a layer built with the old Node. The running container is only replaced at redeployment.",{"title":130,"body":131},"pm2","`pm2 restart all`\n`pm2 update`\nAfter the binary is replaced, `pm2 restart` relaunches the applications; `pm2 update` refreshes the pm2 daemon in memory. The pm2 documentation adds that after a Node upgrade you should also refresh the startup script:\n`pm2 unstartup`\n`pm2 startup`\n`pm2 save`",{"title":133,"body":134},"systemd service or another supervisor","`sudo systemctl restart \u003Cservice>`\nRestart each service one at a time, checking its log and health route before moving to the next. For an application behind a load balancer, take the machine out of the pool during the restart.",{"type":136,"title":137,"body":138},"tip","A process already running keeps the old Node","Replacing the binary does not fix running processes: they keep the old version in memory until they restart. A correct `node -v` on the machine therefore proves nothing about a service started yesterday. After each restart, verify from the process itself: `pm2 jlist` or `pm2 show \u003Cnom>` for the Node version in use, or `process.version` exposed in your health route.",{"type":36,"title":140,"body":141},"If updating is impossible today","Node.js has published no workaround: the only vendor mitigation is the fixed version. Failing that, Rapid7 recommends restricting or disabling the application paths that decompress untrusted Brotli. Here is what that looks like in practice. The following points are risk-reduction measures we suggest, not vendor recommendations, and none replaces the fix.\n\nOn incoming requests, refuse Brotli at the reverse proxy level, for example in nginx: `if ($http_content_encoding ~* br) { return 415; }`. Test with `nginx -t` before reloading, and check that none of your legitimate clients sends `br` bodies. For responses from third parties, advertise only the useful encodings with the `Accept-Encoding: gzip` header, and limit the destinations your outgoing calls may reach. That last measure is partial: a malicious server can answer with `br` even if it was not requested, and the decoder follows the response header. On Vercel, WAF rules block the inbound flow but not the responses your functions fetch; redeploying with a fixed version is still necessary.",{"type":36,"title":143,"body":144},"Do not fix only the Brotli flaw","The same release fixes nine other flaws. They include two high-severity TLS hostname verification bypasses, CVE-2026-105483 and CVE-2026-106069, as well as CVE-2026-105482, a truncation of hostnames containing a NUL character in DNS resolution, also rated High. They do not all affect the same lines: CVE-2026-105483 concerns the 26.x and 24.x lines, while the other two also concern 22.x. An application that validates TLS certificates for its outgoing calls therefore has good reasons to move to the fixed version without waiting to settle the Brotli question.",{"type":36,"title":146,"body":147},"For an agency: one fix per line, not per site","When you carry dozens of sites, the update command takes a minute; the time goes elsewhere. You have to find which machine runs which version for which client, then obtain a restart window. Keep a living register, fed by the inventory above: at the next flaw, a simple filter on the Node line gives the list of sites to handle. The fewer variants in the fleet, the fewer cases to handle by hand, and reseller hosting follows that logic: a single interface for the portfolio and grouped renewals, whereas a collection of disparate servers multiplies the accesses to track. Applications stuck on Node 20 need separate handling: the migration guide linked below this article spares you from discovering the absence of a fix on the day of the next flaw.",{"type":36,"title":149,"body":150},"The official documentation","Node.js security advisory of October 2026: https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases\n\nRapid7 analysis of CVE-2026-111497: https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fetr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder\u002F\n\nVercel bulletin: https:\u002F\u002Fvercel.com\u002Fkb\u002Fbulletin\u002Fnode-js-security-advisory\n\nzlib module documentation: https:\u002F\u002Fnodejs.org\u002Fapi\u002Fzlib.html\n\nnvm documentation: https:\u002F\u002Fgithub.com\u002Fnvm-sh\u002Fnvm\n\nUpdating pm2: https:\u002F\u002Fpm2.keymetrics.io\u002Fdocs\u002Fusage\u002Fupdate-pm2\u002F\n\ndocker build options: https:\u002F\u002Fdocs.docker.com\u002Freference\u002Fcli\u002Fdocker\u002Fbuildx\u002Fbuild\u002F","A fleet of sites to patch, without losing the night","A portfolio of sites is easier to run from one place. With ServOrbit.com reseller hosting, you follow accounts and renewals in a single interface, without multiplying the servers to watch.","Discover the agency offer","\u002Fsolutions\u002Fagences",[156,178,194],{"id":157,"slug":158,"slugs":159,"title":163,"excerpt":164,"readTime":165,"views":166,"isPinned":19,"publishedAt":167,"updatedAt":168,"category":169,"categories":175,"featuredImage":30,"bgImage":31,"posterImage":177,"relatedSolution":30},223,"nodejs-20-end-of-life-migrating-your-vps",{"fr":160,"en":158,"ar":161,"es":162},"nodejs-20-fin-de-vie-migrer-vps","نهاية-دعم-nodejs-20-ترحيل-خادم-vps","nodejs-20-fin-de-vida-migrar-vps","Node.js 20 end of life: migrating your VPS","Node.js 20 has had no security patch since April 30, 2026. How to audit your servers and migrate to Node.js 24 without breaking production.",5,1,"2026-08-05T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":170,"name":171,"slug":172,"color":173,"icon":174},4,"Development","developpement","bg-warning\u002F10 text-warning","dev",[176],{"id":170,"name":171,"slug":172,"color":173,"icon":174},"\u002Fblog\u002Fcovers\u002Fnodejs-20-fin-de-vie-migrer-vps-poster.svg",{"id":179,"slug":180,"slugs":181,"title":185,"excerpt":186,"readTime":187,"views":18,"isPinned":19,"publishedAt":188,"updatedAt":189,"category":190,"categories":191,"featuredImage":30,"bgImage":31,"posterImage":193,"relatedSolution":30},500,"nextjs-16-4-1-15-5-28-rce-update",{"fr":182,"en":180,"ar":183,"es":184},"nextjs-16-4-1-15-5-28-rce-mettre-a-jour","nextjs-16-4-1-15-5-28-تحديث-ثغرة-rce","nextjs-16-4-1-15-5-28-rce-actualizar","Next.js 16.4.1 and 15.5.28: patch the RCE flaws on a VPS","Two critical RCEs and one DoS fixed in Next.js 16.4.1 and 15.5.28. Affected versions, VPS exposure checks, and PM2, Docker and Coolify redeploys.",9,"2026-10-23T00:00:00+00:00","2026-10-23T23:43:01+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[192],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fnextjs-16-4-1-15-5-28-rce-mettre-a-jour-poster.svg",{"id":195,"slug":196,"slugs":197,"title":201,"excerpt":202,"readTime":17,"views":203,"isPinned":19,"publishedAt":204,"updatedAt":205,"category":206,"categories":207,"featuredImage":30,"bgImage":31,"posterImage":209,"relatedSolution":30},382,"vps-automatic-security-updates-debian-ubuntu",{"fr":198,"en":196,"ar":199,"es":200},"securite-vps-mises-a-jour-automatiques-debian-ubuntu","تحديثات-أمان-تلقائية-vps-debian-ubuntu","actualizaciones-seguridad-vps-debian-ubuntu","Automatic Security Updates on Debian\u002FUbuntu VPS","Configure unattended-upgrades on your Debian\u002FUbuntu VPS to automate security patches and reduce attack surface across your client fleet.",2,"2026-09-26T00:00:00+00:00","2026-09-29T14:40:42+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[208],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fsecurite-vps-mises-a-jour-automatiques-debian-ubuntu-poster.svg",1793146020023]