Which Node.js versions are affected by CVE-2026-111497?

CVE-2026-111497 affects all three current Node.js release lines: 22.x (fixed in 22.23.4), 24.x (fixed in 24.22.1), and 26.x (fixed in 26.12.1). Node.js 20.x and earlier are end-of-life and will not receive a patch, but are also vulnerable.

How does the Node.js Brotli decoder bug enable remote code execution?

The bug is an out-of-bounds write in the Brotli decompression library that Node.js bundles. A specially crafted compressed stream triggers a write past the end of the decode buffer. It is reachable through the node:zlib module or automatically when fetch() receives a Brotli-compressed response from an untrusted server.

Is there a workaround if I cannot upgrade Node.js right away?

No. The Node.js security team says no temporary workaround exists for CVE-2026-111497. Patching the standalone Brotli library does not update the bundled copy inside Node.js. The only fix is upgrading to 22.23.4, 24.22.1, or 26.12.1.

Has CVE-2026-111497 been exploited in the wild?

As of October 22, 2026, no in-the-wild exploitation had been reported. A public proof-of-concept achieved code execution only on a deliberately weakened build; on a standard Node.js build, researchers observed a crash and a limited memory read rather than full remote code execution.

Node.js · 2026-10-21 · major

Node.js Brotli decoder bug — RCE risk in all supported versions

Node.js shipped security updates for 22.x, 24.x, and 26.x on October 21, fixing CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that can allow remote code execution. No workaround exists; upgrading is the only fix.

Node.js October 21 2026 Security Releases announcement banner

A memory-safety flaw in the Brotli decompressor bundled with Node.js can be triggered by any Brotli-compressed input from an untrusted source.

Quick facts

CVE	CVE-2026-111497
Severity	High
Impact	Remote code execution
Affected versions	22.x, 24.x, 26.x
Fixed in	22.23.4, 24.22.1, 26.12.1
Workaround	None — upgrade is required
Disclosed	October 21, 2026

What is it?

CVE-2026-111497 is a High-severity out-of-bounds write in the Brotli decoder that Node.js 22.x, 24.x, and 26.x bundle. Any application that decompresses attacker-controlled Brotli data — through node:zlib directly, or through fetch() when a server sends a Brotli-compressed response — is exposed. Node.js shipped patched releases across all three lines on October 21.

How does it work?

The flaw sits in the google/brotli library at the version Node.js was pinned to. A malformed compressed stream triggers a write past the end of the decode buffer, which can corrupt adjacent memory. Brotli v1.2.1 fixed the issue by rejecting invalid input before any out-of-bounds write occurs. Node.js incorporated the same patch and published new release tarballs the same day.

Why does it matter?

Node.js is one of the most widely deployed server runtimes, and proxying or fetching content from third-party servers is a very common pattern. Any such service automatically decompresses Brotli responses and falls within the attack surface. There is no configuration-level workaround: teams must upgrade to 22.23.4, 24.22.1, or 26.12.1.

Who is it for?

Node.js developers on 22.x, 24.x, or 26.x

Frequently asked questions

Which Node.js versions are affected by CVE-2026-111497?: CVE-2026-111497 affects all three current Node.js release lines: 22.x (fixed in 22.23.4), 24.x (fixed in 24.22.1), and 26.x (fixed in 26.12.1). Node.js 20.x and earlier are end-of-life and will not receive a patch, but are also vulnerable.
How does the Node.js Brotli decoder bug enable remote code execution?: The bug is an out-of-bounds write in the Brotli decompression library that Node.js bundles. A specially crafted compressed stream triggers a write past the end of the decode buffer. It is reachable through the node:zlib module or automatically when fetch() receives a Brotli-compressed response from an untrusted server.
Is there a workaround if I cannot upgrade Node.js right away?: No. The Node.js security team says no temporary workaround exists for CVE-2026-111497. Patching the standalone Brotli library does not update the bundled copy inside Node.js. The only fix is upgrading to 22.23.4, 24.22.1, or 26.12.1.
Has CVE-2026-111497 been exploited in the wild?: As of October 22, 2026, no in-the-wild exploitation had been reported. A public proof-of-concept achieved code execution only on a deliberately weakened build; on a standard Node.js build, researchers observed a crash and a limited memory read rather than full remote code execution.

Try it

node --version, then upgrade to 22.23.4, 24.22.1, or 26.12.1