Global -- Node.js issued security releases across all supported lines on October 21, 2026, to fix CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that can lead to remote code execution. A Node.js process that decompresses attacker-controlled Brotli data, including Brotli-encoded HTTP responses it fetches, can be driven to write past the end of its buffer. The result is leaked memory or code execution with the process's privileges.

Ordinary traffic can reach the vulnerable decoder

Node.js bundles Google's Brotli library to back its built-in zlib support. That covers zlib.brotliDecompress(), brotliDecompressSync(), streaming Brotli and transparent decoding of HTTP bodies sent with Content-Encoding: br. Because decompressing untrusted Brotli is common, the bug is reachable across a wide range of services. A web application firewall does not mitigate it.

Ambiguous return value let malformed streams keep decoding

Brotli can split literals, commands and distances into block types and switch between them mid-stream. The function DecodeBlockTypeAndLength returned BROTLI_FALSE to mean both an invalid stream and a need for more input. Block-switch callers treated that value as recoverable, and DecodeLiteralBlockSwitch discarded the result entirely. A malformed block switch therefore did not stop decoding, and the decoder continued with invalid state and wrote out of bounds.

Fixes ship in three lines; end-of-life versions get none

The patched versions are Node.js 22.23.4, 24.22.1 and 26.12.1. End-of-life lines (25.x, 23.x and 20.x and earlier) receive no fix, so operators on those lines must move to a supported release.

Node.js advises treating Brotli decompression of untrusted input as the sensitive path. That includes any call to zlib.brotliDecompress(Sync) on attacker data and any fetch that sends Accept-Encoding: br, including indirect calls through libraries. It also warns against cloning or running unverified exploit or patch scripts from public repositories or social media, and directs users to the official advisory and releases.