Node.js Brotli bug CVE-2026-111497: upgrade Node this week

Two days after PHP2Shell, it is the JavaScript side's turn. The Node.js October 2026 security release fixes CVE-2026-111497, a Brotli decoder bug that the Node.js team says can corrupt memory and may lead to remote code execution. OpenAI's Codex Security team reported it. If you run a Next.js site, a Shopify app, a webhook handler, or a small API on Node, this Node.js Brotli vulnerability is on your list this week.

What actually happened

On October 21, Node.js shipped security releases for every supported line. The fixed versions are 22.23.4, 24.22.1, and 26.12.1. The release covers ten CVEs, four rated High:

• CVE-2026-111497: malformed Brotli input can write past an internal decoder buffer. An attacker who can feed Brotli data to an app that decompresses it with node:zlib can cause a crash, leak process memory, or possibly run code.
• CVE-2026-105482: dns.resolve*() and dns.reverse() can cut a hostname at a NUL byte, so your app can act on a different name than it checked.
• CVE-2026-105483 and CVE-2026-106069: two ways to slip past TLS certificate hostname checks when a host is written as, or loosely resolves to, an IP address.

The rest are medium and low issues, including crypto.randomUUID() entropy caches leaking into snapshots and single-executable apps. The release also updates bundled c-ares, Undici, and OpenSSL. Node.js repeats its standing rule: end-of-life versions are always affected. If you are still on Node 20 or older, there is no patch for you.

Why the Node.js Brotli fix matters for your business

Decompression is everywhere. Any service that accepts compressed uploads, proxies third-party responses, or unpacks webhook payloads may touch node:zlib. You probably did not write that code. A dependency did.

Node hides in places you forget. The main app gets upgraded. The cron worker on an old VPS, the Docker image pinned to node:22.11, the Lambda runtime nobody touched since launch, and the build server do not. Run node -v everywhere, not just in prod.

AI is shortening the clock. This bug came from an AI security agent, the same week AI-found PHP bugs saw attacks within days. Assume the patch diff gets read fast, by both sides.

Sources: Node.js October 21, 2026 security releases.