Node.js patches Brotli code execution across three release lines

Node.js released security updates on October 21 for its 22.x, 24.x and 26.x lines. They fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder that the project says permits remote code execution.

Brotli is a compression format. Its decoder handles compressed bytes in native code, below the application’s JavaScript. An application that passes attacker-controlled Brotli data into the affected decoder exposes that parsing path.

Update the runtime that actually runs

The official security announcement identifies these fixed releases:

The 24.22.1 release notes explicitly list the Brotli fix and its CVE. Use the appropriate patched release or a later supported release containing the fixes. End-of-life versions need migration to a supported line; their absence from this table is no assurance of safety.

Updating an npm package alone does not replace Node’s embedded decoder. Rebuild affected container images or update the deployed runtime, restart the service, and verify its running version. Include background workers and build environments in that inventory.

Exposure depends on the application’s decoding path

Exploitation status: a project-confirmed vulnerability; the reviewed announcement and release notes do not report attacks exploiting it. They also leave detailed triggering conditions unspecified.

Prioritize services that decompress untrusted requests, downloaded responses or uploaded files. Whether a particular framework enables Brotli decoding is a separate configuration question. The advisory does not establish that every Node HTTP endpoint is remotely exploitable.

The project credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer for reporting the Brotli issue. That attribution describes discovery, not evidence that attackers used AI or that a public exploit works.

The same releases repair other trust boundaries

The updates also fix certificate-hostname validation, DNS input validation and the runtime’s permission checks:

• CVE-2026-105483 affects TLS hostname checks in 24.x and 26.x. TLS is the protocol that authenticates and encrypts connections.
• CVE-2026-106069 and CVE-2026-106072 concern non-canonical IP addresses in certificate validation across 22.x, 24.x and 26.x.
• CVE-2026-106073 fixes a permission-model bypass through fs.realpathSync across all three lines. CVE-2026-106071, a filesystem wildcard over-grant, affects 26.x.

The announcement also lists dependency updates and removal of compromised eMudhra intermediate certificate trust. Read the full notice when choosing an upgrade target rather than treating this as a single-library patch.

For tools running untrusted code, keep operating-system isolation and restricted credentials alongside runtime permissions. A repaired permission check does not establish that the runtime is a complete security boundary.

Caveat: the primary notice is terse about the Brotli trigger, so exposure cannot be reduced to a reliable framework-by-framework checklist from this evidence.