Node.js Brotli decoder RCE: CVE-2026-111497

The October 2026 Node.js security release fixes ten issues. One is a Brotli decoder bug the project says permits remote code execution. Here is who is exposed, and the one install method where updating Node does not fix it.

By David Kabel · Updated 2026-10-21 · 4 min read

The four high-severity fixes

The release also has three medium and three low issues, plus dependency updates for c-ares, Undici, OpenSSL on 22.x and 24.x, SQLite on 22.x, and the CA store after the eMudhra intermediate CA compromise. The release notes list the Brotli fix as a cherry-pick into Node's bundled copy of the Brotli library.

Who is exposed

The bug sits in decompression, so the question is whether your code decompresses Brotli data someone else controls:

• Servers that inflate request bodies sent with Content-Encoding: br. Check whether your body parser or framework does this.
• Clients that decode responses from servers you do not control, such as scrapers, webhooks that follow redirects, or proxies that decompress.
• Direct use of zlib.brotliDecompress, brotliDecompressSync or createBrotliDecompress on uploaded files or user data.

An app that only compresses its own responses with Brotli is not decompressing untrusted input. Patch it anyway. The two TLS hostname bypasses weaken certificate checks on outbound connections where the host is an IP address or something that loosely resolves to one.

Check your version

node -v                           # fixed: v22.23.4, v24.22.1, v26.12.1 or later
which -a node                     # more than one node on the box?
# Debian and Ubuntu packages link the system Brotli library:
dpkg -l nodejs libbrotli1 | awk '/^ii/ {print $2, $3}'
ldd "$(command -v node)" | grep -i brotli

If ldd shows libbrotlidec, your Node uses the system library, which is how Debian builds its nodejs package. The official binaries, nvm, NodeSource and the Docker images bundle their own copy, and the Node update fixes them.

Update and restart

# nvm
nvm install 24 && nvm alias default 24

# Official Docker images were rebuilt on 21 October 2026
docker pull node:24 && docker compose build --pull && docker compose up -d

# NodeSource packages
sudo apt update && sudo apt install --only-upgrade nodejs

# Then restart every Node process: pm2, systemd units, containers
pm2 restart all

A running process keeps the old binary loaded. Restart pm2, systemd units and containers after the upgrade, and rebuild images instead of only restarting them.

If you cannot update today

For servers, refuse Brotli-encoded request bodies at the reverse proxy until you can patch. Browsers do not send compressed request bodies, so ordinary users will not notice:

# Stopgap: refuse Brotli-compressed request bodies at the proxy
if ($http_content_encoding ~* "br") {
    return 415;
}

That does not cover outbound requests. For clients that fetch from untrusted hosts, the only fix is the update.

Gotchas

• Debian's Node 20 is end of life upstream. Debian 13 ships nodejs 20.19.2, which the Node.js project no longer supports. It links the system Brotli library, so its exposure depends on Debian's brotli package. On 21 October 2026 the Debian security tracker listed no open issue for brotli and no entry for CVE-2026-111497. Check again before you rely on that.
• Several Node installs on one server. nvm, a system package and a bundled runtime in an Electron or appliance app can sit side by side. which -a node finds the ones on your PATH, not the bundled ones.
• Pinned base images. A Dockerfile pinned to node:24.22.0 stays vulnerable no matter how often you rebuild. Move the pin to 24.22.1 or later.

How this was checked. On 21 October 2026 we read the Node.js security release post and the v24.22.1 release notes, confirmed the Docker Hub update times for the node:26 and node:24.22.1 tags through the Docker Hub API, and read the debian/rules file of Debian's nodejs 20.19.2+dfsg-1+deb13u2 package, which passes --shared-brotli. Not tested: the vulnerability itself.

Sources

1. Wednesday, October 21, 2026 Security Releases, Node.js project
2. Node.js 24.22.1 (LTS), Node.js project
3. Node.js 22.23.4 and Node.js 26.12.1, Node.js project
4. nodejs debian/rules, Debian sources
5. brotli, Debian security tracker