Node.js Brotli RCE CVE-2026-111497: Patch Your Backend Now

Node.js shipped a high-severity security update on October 21 covering all three supported release lines. The headline flaw — CVE-2026-111497 — is an out-of-bounds write in the Brotli decoder that can allow remote code execution. Patched versions are 22.23.4, 24.22.1, and 26.12.1. There is no configuration workaround. You upgrade or you stay exposed.

Your Backend Is Already Decoding Brotli

Here is the part most write-ups bury: you don’t need to write a single line of Brotli-related code to be in the blast radius. Node’s built-in fetch() — backed by undici — automatically decompresses Content-Encoding: br responses from any external API. If your backend calls third-party services and any of them returns Brotli-compressed data, your process is decoding it silently.

Express 5 adds another layer. Express 5.3.0 depends on body-parser 2.x, which added Brotli support in 2.0.0 with inflate defaulting to true. Any Express 5 application that accepts POST requests is exposed to inbound Brotli attack by default. Axios compounds this further by requesting Brotli via Accept-Encoding headers and decompressing transparently. The attack doesn’t require direct access to your server — it reaches you through the data you consume.

What the Bug Actually Does

CVE-2026-111497 sits in the Brotli decoder Node.js bundles at deps/brotli. A specially crafted Brotli stream can declare a block type, then request a block-type switch. In the old code, that caused DecodeBlockTypeAndLength to return false — but the fast-path block-switch wrappers were void functions, so the failure was silently ignored and decoding continued past the end of allocated memory.

The public proof-of-concept, released the same day as the patch, achieved a crash and limited memory read on a standard Node.js build. Full code execution required a deliberately weakened build. That distinction matters: this is not an active fire. But memory corruption that reliably crashes a process is a short step from arbitrary code execution, and a PoC exists. Patch before someone takes that step.

The fix cherry-picks an upstream Brotli commit that returns a new error constant — BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH — instead of continuing silently. You can use that constant to verify you’re running a patched build:

node -e "const z = require('zlib'); console.log(z.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH !== undefined ? 'PATCHED' : 'VULNERABLE')"

Affected Versions

The vulnerability affects every Node.js binary before the October 21 patch across all supported lines. Node.js 20.x and older are end-of-life and will not receive a fix.

• Node.js 26.x — fixed in 26.12.1
• Node.js 24.x — fixed in 24.22.1
• Node.js 22.x — fixed in 22.23.4
• Node.js 20.x and older — EOL, no patch will be released

If you’re still on Node 20, this CVE is a useful forcing function. Plan the upgrade.

How to Patch

Update to the patched version and restart every Node.js process. The specific steps depend on your deployment method.

nvm:

nvm install 24 && nvm alias default 24

Docker: The official node:24, node:lts, and node:latest tags were updated to 24.22.1 early on October 22 UTC. If your Dockerfile is pinned to a specific version, it stays vulnerable no matter how many times you rebuild. Update the pin:

# Vulnerable
FROM node:24.22.0

# Fixed
FROM node:24.22.1

apt (NodeSource packages):

sudo apt update && sudo apt install --only-upgrade nodejs

Direct download: Visit the Node.js downloads page and pull 22.23.4, 24.22.1, or 26.12.1 for your platform.

The Other Nine Vulnerabilities

The October 21 release patched 10 CVEs in total. Beyond the Brotli flaw, three other high-severity issues are worth noting for teams doing TLS certificate validation or custom DNS work. CVE-2026-105483 and CVE-2026-106069 both allow TLS hostname verification bypasses — one via fullwidth Unicode digits in IP address strings (e.g. １２７.0.0.1), another via non-canonical IP formats like 2130706433 that bypass DNS SAN matching. CVE-2026-105482 causes dns.resolve to truncate names containing NUL characters. The same patch fixes all of them.

Read the official Node.js security release post for the full CVE list. For a deeper look at the Brotli decoder mechanics, The Hacker News breakdown is worth your time. A step-by-step patching guide covering servers, Docker images, and CI/CD pipelines is available at Safeguard.sh. Upgrade to 22.23.4, 24.22.1, or 26.12.1. Don’t wait.