Node.js ships fixes for high-severity Brotli decoder flaw

Node.js released its October security updates on October 21, fixing CVE-2026-111497, a Brotli decoder bug the project rates high severity and describes as allowing remote code execution. The patched releases are 22.23.4, 24.22.1 and 26.12.1; Bun 1.4.4 includes the same fix. Every supported Node.js release line before that update had the flaw, and Bun versions before 1.4.4 did too. Node.js 25.x, 23.x, 20.x and earlier have reached end of life and will not be patched. Administrators should upgrade to one of the patched versions, rebuild container images, and move off end-of-life lines; if Node.js came from a Linux distribution package, check the distribution's Brotli advisory as well.

Applications reach the decoder when they decompress Brotli data from an attacker-controlled source. Express 5 and body-parser 2.x handle Brotli-encoded request bodies when the Content-Encoding: br header is present; a vanilla Node.js HTTP server does not decompress those bodies automatically. Node's built-in fetch() automatically decompresses Brotli responses from servers, and direct node:zlib users are exposed when untrusted input reaches the Brotli functions. Semgrep lists further entry points, including Fastify with @fastify/compress, Koa and co-body with inflation, and ultimate-express.

As of October 22, no one had reported seeing the flaw exploited in real attacks. On October 22, a first public proof of concept ran code only against a specially weakened test build; that same day, Imperva researchers reported code execution on the official Node.js 24.22.0 Linux arm64 image, although the exploit was not reliable on every try. Imperva reproduced code execution via both the request-body and response routes, and tested Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0 pinned versions. The fixed Node.js 24.22.1 rejected the same input and no code ran.

The bug is an out-of-bounds write caused by the Brotli decoder confusing incomplete input with invalid input and continuing in an invalid state. In a memory sanitizer test, the decoder proceeded from that state and wrote beyond a buffer. Node.js fixed the issue by importing an upstream Brotli patch, commit 0ed4268a, which causes the decoder to halt with a format error at that point rather than proceed. The upstream project shipped the same fix in Brotli 1.2.1, 1.1.1 and 1.0.10.

The Node.js advisory lists no workaround inside the runtime. As a stopgap, administrators can reject Brotli-encoded requests at a reverse proxy, load balancer or middleware; additionally, on October 21 Vercel announced firewall rules to block the attack on inbound requests. These measures do not protect against Brotli responses retrieved from other servers, and only a runtime upgrade removes the flaw.