Ten fixes arrived from Node.js on October 21, spread across the 22.x, 24.x and 26.x release lines. The most serious is an out-of-bounds write inside the Brotli decompression code that ships with the runtime itself, tracked as CVE-2026-111497 and rated high.
Does your code reach the decoder?
Patched builds are 22.23.4 and 24.22.1 on the long-term lines, plus 26.12.1 on current. Node 20 and anything older have reached end of life and will not receive a build, which leaves those deployments needing a migration rather than a download.
The defect sits in vendor code, not in anything an application author wrote. Node invokes the decoder every time it expands Brotli data, through node:zlib directly or automatically when fetch() receives a Brotli-compressed response. Exposure means decompressing bytes an adversary chose: a request body, or a response fetched from another server.
Upstream Brotli patched the same flaw in 1.2.1, 1.1.1 and 1.0.10 that day, so other projects embedding the library may also need updating. Google’s copy was corrected in source back in February but only shipped as a security release in October.
Remote code execution is how the project describes the worst case, and the evidence is thinner. A proof of concept posted October 22 achieved execution only against a deliberately weakened test build; on a stock build its author saw a crash and a limited memory read. Nobody has reported attacks in the wild.
