Node.js shipped security releases on 21 October 2026 for all three supported lines, fixing ten flaws. The most serious is a buffer overflow in the Brotli decompression code that Node.js bundles, which the project says can lead to remote code execution.
What happened
The bug is tracked as CVE-2026-111497 and rated 9.2 under CVSS 4.0 in the CVE record. It is an out-of-bounds write in the Brotli decoder, triggered by malformed compressed input. The CVE record scopes the flaw to Google Brotli versions 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1. Node.js copied the upstream patch into its own bundled copy.
Node.js decompresses Brotli whenever an application calls the zlib module directly, or automatically when code calls fetch() on a response that arrives with Brotli compression. An attacker only has to control the compressed data being decoded, for example a request body or a response pulled from another server.
Three further high-severity fixes landed in the same release: CVE-2026-106069 and CVE-2026-105483 both allow a TLS hostname-check bypass by writing an IP address in a non-standard form, and CVE-2026-105482 lets dns.resolve truncate a hostname at an embedded null byte.
Who is affected
Every Node.js installation on the 22.x, 24.x and 26.x lines that handles untrusted or fetched Brotli data is exposed. The fixed builds are below.
- Node.js 22.23.4 on the 22.x long-term support line
- Node.js 24.22.1 on the 24.x long-term support line
- Node.js 26.12.1 on the current line
- Node.js 20.x and earlier: end-of-life, no fix will be issued
Software that bundles its own Brotli library, rather than calling Node.js, needs the matching Brotli update to 1.0.10, 1.1.1 or 1.2.1.
What to do now
Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, and move anything still on 20.x onto a supported line. The advisory offers no workaround inside Node.js for the Brotli flaw.
- Inventory every runtime that runs your applications, including container base images and CI build images, not just developer laptops.
- Rebuild and redeploy containers on the patched base image rather than patching inside a running container.
- If a service cannot be upgraded today, terminate Brotli at a proxy that rejects malformed streams, and stop accepting attacker-supplied compressed bodies where the application does not need them.
- Check bundled Brotli versions in other software you ship or host; the same CVE applies to the library itself.
What this means for South African businesses
Most South African SMEs run WordPress and PHP rather than Node.js, so this is not a repeat of the PHP2Shell emergency. The exposure sits in custom web applications, internal dashboards and the tooling that hosts them, which is exactly the code most SMEs never inventory. No exploitation in the wild had been reported as of 22 October, and the public proof-of-concept only reached code execution against a deliberately weakened build. Treat this as a scheduled patch with a tight deadline rather than a fire drill, and confirm who owns each Node.js service before you need to prove it.
Source: The Hacker News and the CVE record for CVE-2026-111497.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.