Node.js CVE-2026-111497, now exploited: what to update

As of November 5, 2026, 14:30 JST (05:30 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9). This page covers the Node.js security release of October 21, 2026, and notes the next one, announced for November 11.

Updated November 5, 2026, 14:30 JST: CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27. The NVD now scores it 9.8 (Critical) in CVSS 3.1. The other nine CVEs have published records and scores. Node.js has announced another security release for on or shortly after November 11. Vercel, AWS Lambda, Debian, and Ubuntu now ship fixes; the platform and install tables were checked again.

Yes, update now: CVE-2026-111497, which the Node.js advisory titles “Node.js Brotli decoder out-of-bounds write permits remote code execution,” is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026.

The same releases fix 9 more vulnerabilities. Install a fixed version, or any later one in the same line, and restart your processes. Node 20 and Node 25 get no fix. Node.js has also announced its next security release, for 26.x, 24.x, and 22.x, “on or shortly after, Wednesday, November 11, 2026,” so plan a second update that week.

Your app can reach the bug without ever calling Brotli itself: Node's built-in fetch() decompresses Content-Encoding: br responses, and Express 5's body parser decompresses br request bodies by default. As checked on November 5, 14:25–14:26 JST, CVE-2026-111497 has a CVSS 4.0 score of 9.2 (Critical) from Google as the CVE Numbering Authority, and the NVD's own CVSS 3.1 score is 9.8 (Critical). CISA's catalog gives US federal agencies until November 10, 2026 to fix it, under its directive BOD 26-04. None of the other nine CVEs is in the catalog.

Below: the fixed versions, the 10 CVEs as the advisory ranks them, why the Brotli bug reaches past Node, a table to check whether your code is reachable, what each hosting platform and install channel has said or shipped, and the update steps.

Which Node.js versions are fixed

The statuses and dates are from the Node.js release schedule (checked November 5, 14:25 JST). The three releases were published on GitHub on October 21 at 10:38 UTC (19:38 JST), and each release note calls itself "a security release". The advisory adds one line for the two lines without a fix: "End-of-Life versions are always affected when a security release occurs." Later releases in a line keep the fix: 24.22.2 (October 27) and 26.13.0 (October 28) are newer, though neither is a security release, per Node.js's release index (checked November 5, 14:24 JST).

The next security release, announced for November 11

On November 3, Node.js announced that it "will release new versions of the 26.x, 24.x, 22.x releases lines on or shortly after, Wednesday, November 11, 2026," and that "The highest severity issue fixed in this release is HIGH." The announcement names no CVEs or versions yet (checked November 5, 14:25 JST). Until it ships, 22.23.4, 24.22.1, and 26.12.1 or later are the versions to run for CVE-2026-111497. Once it ships, update again to the new release in your line.

Seven releases from other projects reach end of life in November 2026, among them .NET 8 and PostgreSQL 14: End of life in November 2026: .NET 8 and 9, PostgreSQL 14.

The 10 CVEs, as the advisory ranks them

The titles below are the Node.js advisory's, word for word, and so are the severity labels, which the advisory writes in lowercase (checked October 22, 11:54 JST, and unchanged on November 5, 14:25 JST). The scores are each CVE record's own, from the CVE Numbering Authority (CNA) that published it (checked November 5, 14:25 JST).

The order is this page's: the Brotli bug first, because it is the only one the advisory says permits remote code execution, it is reachable through default code paths, and it is the one being exploited. The advisory itself lists the High issues in a different order and gives no attack details.

CVE-2026-111497 is being exploited. CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026, as "Google Brotli Unchecked Return Value Vulnerability", with a due date of November 10, 2026 for US federal agencies under its directive BOD 26-04. CISA's description says the bug lets "a remote unauthenticated attacker" corrupt decoder memory, "disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream." Its enrichment of the CVE record marks exploitation as "active" (catalog version 2026.11.04 and the CVE record, checked November 5, 14:25 JST). None of the other nine CVEs is in the catalog.

Its score: 9.2 Critical from Google, 9.8 Critical from the NVD. Google, as the CNA for this ID, published its record at CVE.org on October 22 at 22:35 JST (13:35 UTC), titled "Out-of-Bounds Write in Google Brotli Decoder", with the CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The NVD has since analyzed the record and gives its own CVSS 3.1 score, 9.8 Critical, beside Google's (checked November 5, 14:26 JST). The Node.js advisory still labels the bug High.

AT:P in that vector means, in the CVSS 4.0 specification's words, "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." Google's record doesn't say which condition it has in mind. It names what the attacker sends: "a crafted Brotli-compressed stream". The reach table below shows whether one can get to your decoder.

HackerOne, as their CNA, published the other nine records on October 23 at 16:15 UTC (October 24, 01:15 JST), each with the CVSS 3.0 score in the table above. CISA's enrichment, added on November 2, marks exploitation "none" for each of them (checked November 5, 14:25 JST).

Two notes on the labels. Vercel's bulletin says that researchers "demonstrated process-memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x"; the Node.js advisory doesn't say this itself. And the fix commit for CVE-2026-105483 calls its bug "a low-severity bug that's not easy to exploit", while the advisory labels it High.

The Brotli bug is in Google's library, not only in Node

Node.js bundles the Brotli decoder from Google's open-source brotli library. Node's fix for CVE-2026-111497 is a cherry-pick of brotli commit 0ed4268a, "Detect and report invalid stream earlier.", which is dated February 27, 2026. On October 21 between 19:26 and 19:27 UTC (October 22, 04:26–04:27 JST), google/brotli published v1.2.1, v1.1.1, and v1.0.10, each listing "CVE-2026-111497: out-of-bounds write permits remote code execution" under SECURITY. Google's CVE record, published on October 22 at 22:35 JST, tells users to update "any Brotli libraries or binaries" to "1.0.10 or 1.1.1 or 1.2.1". The brotli repository has published no GitHub security advisory (checked October 23, 00:40 JST).

So the fix reaches you through whatever supplies your decoder, and that isn't always Node's own build:

• Debian and distributions built like it. Debian builds its nodejs package with --shared-brotli (its debian/rules, checked 12:00 JST), so a Debian Node uses the system Brotli library. There, the Brotli fix has to come as a Brotli library update, and the TLS and DNS fixes as a nodejs update. Debian has shipped the library update: brotli 1.0.9-2+deb12u1 for bookworm and 1.1.0-2+deb13u1 for trixie, from its security repository (security tracker, checked November 5, 14:27 JST).
• Homebrew. Homebrew builds its node, node@24, and node@22 formulas with --shared-brotli against its own brotli formula (checked 12:29 JST). That formula moved to 1.2.1 on October 22 at 06:34 JST, and its bottles (prebuilt packages) followed at 10:29 JST. The node formulas with the TLS and DNS fixes followed, each with bottles: node@22 22.23.4 at 13:54 JST, node 26.12.1 at 15:01 JST, and node@24 24.22.1 at 15:39 JST on October 22 (checked October 23, 00:42 JST). So brew upgrade brotli node (or node@24, node@22), then a restart of your Node processes, brings in all the fixes.
• Bun. Bun 1.4.4, released on October 22 at 19:11 JST, builds brotli v1.2.1. The commit that moved it there says "Fixes #46352", the issue that reported Bun's brotli lacked the fix, and the release notes' Security section lists Brotli among what its fixes affect. The release notes don't name CVE-2026-111497 (checked October 23, 00:36 JST). Run bun upgrade.
• Cloudflare Workers. Workers runs Cloudflare's own runtime, workerd, not Node.js. Cloudflare's docs say that in Workers, node:zlib "provides compression functionality implemented using Gzip, Deflate/Inflate, and Brotli". Cloudflare's one statement about CVE-2026-111497 is an emergency WAF release on October 25: two Managed Ruleset rules, one for requests with Content-Encoding: br and one for Next.js's /_next/image endpoint, both "enabled by default with their action set to Log". It says nothing about Workers itself, and its blog has no post on the bug (developer changelog and blog, checked November 5, 14:27 JST). Whether Workers is affected is not known.

The same Brotli bug is fixed in .NET, the Python packages Brotli and brotlicffi, PHP's Windows builds and its brotli extension, and the Ruby brotli gem, each in its own release: Brotli CVE-2026-111497 fixes for .NET, Python, PHP, and Ruby.

Is your app reachable?

Node.js doesn't decode Brotli on its own; your code or a library has to hand it Brotli data. Whether that data can come from someone else decides how soon you need the update. Each row's "yes" is from the code or docs named in it (checked October 22, 11:56–12:29 JST).

An app an AI coding agent wrote for you can sit in the first or third row without you knowing. Search your code and package.json for express.json, express.urlencoded, express.raw, express.text, bodyParser, fetch(, axios, got, node-fetch, and zlib.brotli to find out.

Platform status: what each host has said

This table holds only what each platform says on its own pages. It is the part of this page that goes stale first.

Where you install Node yourself, the channel decides when you get the fixed build:

Update Node.js and restart

1. Find the version you run

Run node -v on each machine and in each image, or log process.versions.node from the running app. You need 22.23.4, 24.22.1, 26.12.1, or later in the same line. Once Node.js ships the release it announced for on or shortly after November 11, update to it.

2. Check which Brotli library your Node uses

On Linux, run ldd "$(command -v node)" | grep -i brotli. On macOS, run otool -L "$(command -v node)" | grep -i brotli. A libbrotlidec line means your Node uses a separate Brotli library, so the Brotli fix comes from that library's package: your distribution's on Linux, or Homebrew's brotli (brew list --versions brotli should show 1.2.1). No output means the Brotli decoder is built into the Node binary.

3. Install a fixed build

With nvm, run nvm install 22 (or 24, 26), then nvm alias default 22. With NodeSource, run sudo apt-get update && sudo apt-get install nodejs. With Homebrew, run brew upgrade brotli node, or name node@24 or node@22 in place of node if you use one of those.

4. Rebuild everything that has Node inside it

Rebuild Docker images with docker build --pull, so the base image is fetched again rather than taken from your cache. Rebuild Lambda container images from the Lambda base image, and check node -v inside the result. Rebuild single executable applications (SEAs) and startup snapshots too: they carry the Node binary inside them, and CVE-2026-106074 is about them.

5. Restart every running process

A running process keeps the old Node binary in memory until it restarts. Restart pm2 apps, systemd services, and containers, then run step 1 again against the running app.

6. Move off Node 20 and Node 25

Neither line gets this fix or any later one. Move Node 20 apps to 22 or 24, and Node 25 apps to 26 or 24. On Vercel, that means changing the Node.js version in project settings or engines.node and redeploying.

Tell your users what you updated

Once the fixed build is running, the people who use your app may ask whether they need to do anything. Ask your coding agent to write the answer as one HTML page: that you moved to a fixed Node.js release, when you restarted, and what users should do, if anything.

Convika turns that file into a link: sign up free, drop the file on the upload screen, check the private preview, and publish. On the free plan the page is public: search engines and Convika's gallery may list it, so leave out exact versions, hostnames, IP addresses, and anything internal.

Publish my update page

The TLS and DNS fixes

Three of the High issues aren't about Brotli. Two let a TLS certificate check pass for the wrong host when the hostname is shaped like an IP address: CVE-2026-106069 on 22.x, 24.x, and 26.x, and CVE-2026-105483 on 24.x and 26.x only. The third, CVE-2026-105482, makes dns.resolve cut a name off at a NUL character. The same release also blocks the compromised eMudhra intermediate certificates: the advisory lists "ca-cert (eMudhra Intermediate CA Compromise)", and the release notes include pull request #66871, "tls: reject chains containing blocked public keys" (checked 12:01 JST). For your own website's certificate, Chrome's eMudhra root removal on October 27: what to do explains which certificates chain to the root Chrome plans to remove and how to check yours. In Japanese, eMudhra 中間証明書の問題：自分のサイトは対象？ explains which certificates must be replaced and how to check who issued yours.

What not to do

• Don't turn off certificate checks with rejectUnauthorized: false or NODE_TLS_REJECT_UNAUTHORIZED=0 if a connection fails after the update. That removes the check the TLS fixes repair.
• Don't treat a web application firewall as the fix. Vercel, which deployed one, says it "reduces exposure but does not replace patching", and no firewall in front of your app sees the responses your own fetch() calls receive.
• Don't count on npm audit. It "submits a description of the dependencies configured in your project" to the registry, and the Node.js runtime isn't one of them.

If what you built is only a page

Some things an AI agent builds are a single page and a sign-up form, with no server code of their own. A page published on Convika is HTML that Convika serves at a convika.page address or your own domain, and its scripts run in the visitor's browser, so there is no Node.js process of yours to update for this release (publish an HTML page, add a form without a backend). If what you built needs a server, a database, or a login, this doesn't apply, and the steps above do.

Updates to this page

• November 5, 2026, 14:30 JST: CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-111497 since October 27, so the exploitation answer is now yes. The NVD's own CVSS 3.1 score, 9.8. The other nine CVE records and their CVSS 3.0 scores. Node 26 as Active LTS, and the security release Node.js announced for November 11. Vercel's finished rollout, AWS bulletin 2026-155-AWS for Lambda, Cloudflare's WAF rules, Debian's and Ubuntu's fixed brotli packages, the GitHub runner image cache, and Homebrew's newer versions. The fixed versions are unchanged.
• October 23, 2026, 00:45 JST: CVE-2026-111497's CVSS 4.0 score, 9.2 (Critical), from Google as its CNA. Homebrew's node, node@24, and node@22 with the fixed versions. Bun 1.4.4 with the Brotli fix. Debian's tracker entry. The other platform and install rows were checked again and haven't changed.
• October 22, 2026, 12:30 JST: first version.

This page changes when Node.js ships the security release it announced for on or shortly after November 11, when Netlify or Cloudflare says anything about its own runtime, and when AWS or CISA changes its entry for this bug. The same week as the October release: PHP October 2026 security release: what to update, LiteLLM 1.107.0 compromised on PyPI and Docker: what to do, Railway security incident, October 2026: what to do now, GitLab CVE-2026-110264: which version to upgrade to and how, Pillow CVE-2026-112398 and 13.0.0: what to update, and Laravel CVE-2026-114509 TokenGuard bypass: what to update.

Frequently asked questions

Which Node.js versions are affected by CVE-2026-111497?

Every 22.x before 22.23.4, every 24.x before 24.22.1, and every 26.x before 26.12.1, per the Node.js advisory of October 21, 2026. Node 20 and Node 25 are past end of life, and the advisory says end-of-life versions "are always affected".

Is Node.js 22 affected?

Yes. 22.x before 22.23.4 has CVE-2026-111497 and every other issue in this release except CVE-2026-105483, CVE-2026-106070, and CVE-2026-106071. Update to 22.23.4 or later, and again to the 22.x release Node.js has announced for on or shortly after November 11, 2026.

Do I need to update if my app runs on Vercel, AWS Lambda, or Cloudflare Workers?

On Vercel, yes: every new deployment since October 28 at 11am PT runs a patched Node.js, so redeploy; Node 20 projects must move to 22.x or 24.x first. On AWS Lambda, it depends on the function's runtime update mode. The zip runtimes now run 22.23.4, 24.22.2, and 26.13.0, per AWS bulletin 2026-155-AWS, so Auto mode needs nothing. In Function update mode, redeploy; in Manual mode, move the function to Auto mode, as AWS recommends for both. Container images need a rebuild. Cloudflare has said nothing about Workers itself; on October 25 it added WAF rules for the bug that only log by default (checked November 5, 14:27 JST).

Is Node 20 still supported?

No. Node 20 reached end of life on April 30, 2026, and gets no fix for this release. Move to 22 or 24.

Does npm audit find this vulnerability?

No. npm audit checks the dependencies listed in your project, and the Node.js runtime isn't one of them. Check node -v instead.

Do I need to rebuild my Docker image?

Yes. An image keeps the Node it was built with. Rebuild with docker build --pull from node:22, node:24, or node:26, or from an exact fixed tag, then redeploy.

Am I affected if my code never uses Brotli?

Possibly. Node's fetch() decompresses Brotli responses, and Express 5 decompresses Brotli request bodies by default, so outside Brotli data can reach the decoder without your code naming Brotli.

Is CVE-2026-111497 being exploited?

Yes. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a November 10 due date for US federal agencies, and its enrichment of the CVE record marks exploitation as "active" (checked November 5, 14:25 JST). The Node.js advisory doesn't mention attacks. Vercel's bulletin says researchers demonstrated command execution on unpatched versions. Update to a fixed version and restart now.

What is the CVSS score of CVE-2026-111497?

9.2, Critical, in CVSS 4.0, with the vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Google assigned it as the CVE Numbering Authority when it published the record on October 22 at 22:35 JST. The NVD's own score is 9.8, Critical, in CVSS 3.1 (checked November 5, 14:26 JST). The Node.js project labels the bug High.

Sources

Times are in JST (UTC+9), on October 22, 2026, unless they say October 23 or November 5.

• Node.js: Wednesday, October 21, 2026 Security Releases (11:54; October 23, 00:43; November 5, 14:25)
• Node.js: Wednesday, November 11, 2026 Security Releases, posted November 3 (November 5, 14:25)
• Node.js v22.23.4 release, v24.22.1, and v26.12.1 (11:54), and the Node.js release index (November 5, 14:24)
• Node.js release schedule (11:54; November 5, 14:25)
• nodejs/node commit cd4b05469c, "tls: fix ip normalization regression" (12:01)
• nodejs/node pull request #66871 (12:01)
• CVE.org: CVE-2026-111497 and the other nine IDs (11:54; October 23, 00:41–00:42; November 5, 14:25, through the CVE Services API)
• NVD: CVE-2026-111497 and the other nine IDs (11:54; October 23, 00:41–00:42; November 5, 14:26 for CVE-2026-111497)
• FIRST: CVSS v4.0 specification, Attack Requirements (October 23, 00:40)
• CISA Known Exploited Vulnerabilities catalog, version 2026.10.21 (11:54; October 23, 00:42) and version 2026.11.04 (November 5, 14:25)
• google/brotli releases and commit 0ed4268a (11:54), and its security advisories (October 23, 00:40)
• undici: lib/web/fetch/index.js (11:56)
• axios: lib/adapters/http.js, got: the decompress option, and node-fetch: src/index.js (12:29)
• body-parser: README and HISTORY.md; Express package.json (12:00)
• Vercel: Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) (11:55; October 23, 00:43; November 5, 14:26)
• AWS Security Bulletins (11:55; October 23, 00:43), bulletin 2026-143 (October 23, 01:04), bulletin 2026-155-AWS: CVE-2026-111497 (November 5, 14:27), and Lambda: Understanding how Lambda manages runtime version updates (11:55; October 23, 00:37)
• Netlify: Functions optional configuration (11:55), and Netlify Support Forums: Updates and Netlify changelog (11:55; October 23, 00:43; November 5, 14:28)
• Cloudflare changelog and its emergency WAF release of October 25, Cloudflare blog (11:56; October 23, 00:43; November 5, 14:27), and Workers docs: zlib (12:01)
• Docker Hub: node (11:56; October 23, 00:43)
• NodeSource apt repository, node_22.x package index, and the node_24.x and node_26.x indexes (11:56; October 23, 00:43)
• actions/node-versions manifest, setup-node: check latest version, and GitHub's Ubuntu 24.04 runner image (11:56, 12:29; October 23, 00:43; the runner image November 5, 14:29)
• Homebrew: node, node@24, node@22, brotli, the node formula source, and pull requests #320030, #320031, and #320032 (11:56, 12:29; October 23, 00:32–00:42; the formulas November 5, 14:29)
• Debian security tracker: CVE-2026-111497 and Debian nodejs debian/rules (11:56, 12:00; October 23, 00:42; the tracker November 5, 14:27)
• Ubuntu CVE reports (11:56; October 23, 00:45) and Ubuntu: CVE-2026-111497 (November 5, 14:27)
• Bun v1.4.4 release notes (October 23, 00:36), Bun commit 2a5cbbcb08 (October 23, 00:36–00:37), issue #46352, and pull request #46351 (11:56; October 23, 00:36)
• npm audit documentation (12:02)