Global -- Node.js issued security releases across all supported lines on October 21, 2026, to fix CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that can lead to remote code execution. A Node.js process that decompresses attacker-controlled Brotli data, including Brotli-encoded HTTP responses it fetches, can be driven to write past the end of its buffer. The result is leaked memory or code execution with the process's privileges.