High-Severity Remote Code Execution Vulnerability in Node.js Brotli Decoder (CVE-2026-111497)

Executive Summary

On October 21st, 2026, the Node.js project released security updates for its 26.x, 24.x, and 22.x release lines that fix a high-severity vulnerability in the runtime's Brotli decoder. Tracked as CVE-2026-111497, the flaw is an out-of-bounds write that Node.js states permits remote code execution (RCE) when the decoder processes crafted compressed data. All three supported release lines are affected, and Node.js states that end-of-life versions are always affected when a security release occurs.

Node.js is the JavaScript runtime behind a large share of web servers, APIs, and build tooling. Applications that decompress Brotli content from untrusted sources warrant the closest attention. Node.js has not published the exact conditions an attacker needs to trigger the flaw.

Node.js does not report exploitation in the wild, and no public proof-of-concept (PoC) is known at the time of writing. Given the breadth of Node.js deployments and the potential for code execution, Beazley Security recommends affected organizations apply available fixes as soon as possible.

Affected Systems or Products

Mitigations / Workarounds

Node.js has not published workarounds for this vulnerability. Upgrading to the fixed release for each supported major version is the only remediation Node.js provides, and the project states that end-of-life versions are always affected by a security release. Systems on unsupported versions need to move to a supported version as soon as possible.

If patching cannot be immediately applied, the following may help to temporarily reduce risk:

• 

  Temporarily block inbound traffic from untrusted sources to affected systems.

• 

  Prioritize updating any internet-facing services and any workloads that are externally facing.

Patches

Node.js has released 26.12.1, 24.22.1, and 22.23.4 to address this vulnerability, available from the Node.js October 2026 security release announcement and the Node.js download page. Applications that bundle the runtime, such as container images, need to be rebuilt on a fixed release and their services restarted for the fix to take effect.

Technical Details

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that Node.js bundles as a dependency. When the decoder handles crafted input, it can write outside its intended memory region, which Node.js states permits remote code execution. The Node.js fix cherry-picks a specific upstream Brotli commit into the bundled dependency.

Node.js credits Khai Tran and Sylvie Mayer at OpenAI Codex Security for the discovery of this vulnerability. Node.js has not published the preconditions for exploitation, such as which APIs or input paths reach the vulnerable code, and no further technical detail or public PoC is available at the time of writing. Additionally, there are no reports of exploitation in-the-wild when the advisory was published.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.

Sources

• 

  NVD: CVE-2026-111497

• 

  Node.js: Wednesday, October 21, 2026 Security Releases

• 

  SecurityOnline: Node.js Fixes 10 Flaws, Including Brotli RCE and TLS Hostname Bypasses

• 

  Cyber Security News: Node.js Releases Security Updates to Fix High-Severity TLS, DNS and Brotli Vulnerabilities