---
title: "Node.js Brotli RCE CVE-2026-111497: what to update"
description: "Node.js fixed a Brotli decoder bug that permits remote code execution. Patched in 22.23.4, 24.22.1 and 26.12.1. Who is exposed and how to update."
source: "https://wardio.net/guides/nodejs-brotli-cve-2026-111497/"
---

**Patching**

# Node.js Brotli decoder RCE: CVE-2026-111497

The October 2026 Node.js security release fixes ten issues. One is a Brotli decoder bug the project says permits remote code execution. Here is who is exposed, and the one install method where updating Node does not fix it.

By David Kabel · Updated 2026-10-21 · 4 min read

**The short answer**

Update to Node.js 22.23.4, 24.22.1 or 26.12.1 and restart every Node process. The bug is an out-of-bounds write in Brotli decompression, so code that decompresses attacker-supplied Brotli data is exposed. Node.js 20 and older are end of life and get no fix. If your Node comes from Debian or Ubuntu packages, the fix has to come through the system `libbrotli` package instead.

## The four high-severity fixes

| CVE | Issue | Lines affected |
| --- | --- | --- |
| CVE-2026-111497 | Brotli decoder out-of-bounds write permits remote code execution | 26, 24, 22 |
| CVE-2026-105483 | TLS hostname check bypass when the IP is written in fullwidth digits | 26, 24 |
| CVE-2026-106069 | TLS hostname check bypass when the host loosely resolves to an IP | 26, 24, 22 |
| CVE-2026-105482 | dns.resolve truncates names containing a NUL character | 26, 24, 22 |

The release also has three medium and three low issues, plus dependency updates for c-ares, Undici, OpenSSL on 22.x and 24.x, SQLite on 22.x, and the CA store after the eMudhra intermediate CA compromise. The release notes list the Brotli fix as a cherry-pick into Node's bundled copy of the Brotli library.

## Who is exposed

The bug sits in decompression, so the question is whether your code decompresses Brotli data someone else controls:

-   **Servers that inflate request bodies** sent with `Content-Encoding: br`. Check whether your body parser or framework does this.
-   **Clients that decode responses** from servers you do not control, such as scrapers, webhooks that follow redirects, or proxies that decompress.
-   **Direct use** of `zlib.brotliDecompress`, `brotliDecompressSync` or `createBrotliDecompress` on uploaded files or user data.

An app that only compresses its own responses with Brotli is not decompressing untrusted input. Patch it anyway. The two TLS hostname bypasses weaken certificate checks on outbound connections where the host is an IP address or something that loosely resolves to one.

## Check your version

```
node -v                           # fixed: v22.23.4, v24.22.1, v26.12.1 or later
which -a node                     # more than one node on the box?
# Debian and Ubuntu packages link the system Brotli library:
dpkg -l nodejs libbrotli1 | awk '/^ii/ {print $2, $3}'
ldd "$(command -v node)" | grep -i brotli
```

If `ldd` shows `libbrotlidec`, your Node uses the system library, which is how Debian builds its `nodejs` package. The official binaries, nvm, NodeSource and the Docker images bundle their own copy, and the Node update fixes them.

## Update and restart

```
# nvm
nvm install 24 && nvm alias default 24

# Official Docker images were rebuilt on 21 October 2026
docker pull node:24 && docker compose build --pull && docker compose up -d

# NodeSource packages
sudo apt update && sudo apt install --only-upgrade nodejs

# Then restart every Node process: pm2, systemd units, containers
pm2 restart all
```

A running process keeps the old binary loaded. Restart pm2, systemd units and containers after the upgrade, and rebuild images instead of only restarting them.

## If you cannot update today

For servers, refuse Brotli-encoded request bodies at the reverse proxy until you can patch. Browsers do not send compressed request bodies, so ordinary users will not notice:

```
# Stopgap: refuse Brotli-compressed request bodies at the proxy
if ($http_content_encoding ~* "br") {
    return 415;
}
```

That does not cover outbound requests. For clients that fetch from untrusted hosts, the only fix is the update.

## Gotchas

-   **Debian's Node 20 is end of life upstream.** Debian 13 ships nodejs 20.19.2, which the Node.js project no longer supports. It links the system Brotli library, so its exposure depends on Debian's `brotli` package. On 21 October 2026 the Debian security tracker listed no open issue for brotli and no entry for CVE-2026-111497. Check again before you rely on that.
-   **Several Node installs on one server.** nvm, a system package and a bundled runtime in an Electron or appliance app can sit side by side. `which -a node` finds the ones on your PATH, not the bundled ones.
-   **Pinned base images.** A Dockerfile pinned to `node:24.22.0` stays vulnerable no matter how often you rebuild. Move the pin to `24.22.1` or later.

**How this was checked.** On 21 October 2026 we read the Node.js security release post and the v24.22.1 release notes, confirmed the Docker Hub update times for the `node:26` and `node:24.22.1` tags through the Docker Hub API, and read the `debian/rules` file of Debian's nodejs 20.19.2+dfsg-1+deb13u2 package, which passes `--shared-brotli`. Not tested: the vulnerability itself.

## Sources

1.  [Wednesday, October 21, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), Node.js project
2.  [Node.js 24.22.1 (LTS)](https://nodejs.org/en/blog/release/v24.22.1/), Node.js project
3.  [Node.js 22.23.4](https://nodejs.org/en/blog/release/v22.23.4/) and [Node.js 26.12.1](https://nodejs.org/en/blog/release/v26.12.1/), Node.js project
4.  [nodejs debian/rules](https://sources.debian.org/src/nodejs/20.19.2+dfsg-1+deb13u2/debian/rules/), Debian sources
5.  [brotli](https://security-tracker.debian.org/tracker/source-package/brotli), Debian security tracker

## Questions

### What is CVE-2026-111497?

CVE-2026-111497 is a high-severity out-of-bounds write in the Brotli decoder used by Node.js. The Node.js project says it permits remote code execution. It affects the 22.x, 24.x and 26.x release lines and was fixed on 21 October 2026 by cherry-picking a fix into Node's bundled copy of the Brotli library.

### Which Node.js versions fix the Brotli vulnerability?

Node.js 22.23.4, 24.22.1 and 26.12.1. End-of-life lines such as Node.js 20 get no fix, and the Node.js project says end-of-life versions are always affected when a security release ships.

### Am I affected if I installed Node.js from Debian or Ubuntu packages?

Possibly, but the fix comes from a different package. Debian builds its nodejs package with --shared-brotli, so it uses the system libbrotli library instead of Node's bundled copy. Updating to a new upstream Node.js release does not apply there. Watch the brotli package in your distribution's security tracker.

### Which Node.js applications are exposed to the Brotli bug?

Anything that decompresses Brotli data an attacker controls. That includes servers that inflate request bodies sent with Content-Encoding: br, and clients that fetch from untrusted servers and decode br responses. Code that never decompresses Brotli does not reach the bug, but patch anyway because the same release fixes three other high-severity issues.

**Node services you have not touched in months?**

The free review finds every runtime on your servers and how each one gets patched. [Pricing](/pricing/).

[Free server review](/contact/)