Skip to content

SecurityNode.js / Google Brotli

Fixed

Node.js patches a Brotli decoder RCE (CVE-2026-111497), now on CISA's exploited list, plus TLS hostname bypasses

Official announcement from Node.js / Google Brotli (opens in a new tab)Benchmarks & resources

Node.js at a glance

Node.js 26.12.1, 24.22.1 and 22.23.4 (Oct 21, 2026) fix ten CVEs, led by an out-of-bounds write in the bundled Brotli decoder that CISA added to its Known Exploited Vulnerabilities catalog on Oct 27. Bun, Envoy, Istio, Python, .NET and PHP Windows builds also shipped fixes.

Node.js: status

FixedCritical
Affected
  • Node.js 26.x before 26.12.1, 24.x before 24.22.1 and 22.x before 22.23.4; end-of-life lines are also affected
  • Google Brotli 1.0.3 through 1.2.0 (fixed in 1.0.10, 1.1.1 and 1.2.1)
  • Software that bundles the Brotli decoder, including Bun before 1.4.4, Envoy Proxy and Istio configured to decompress Brotli, Python brotli and brotlicffi, .NET 8, 9 and 10, and PHP Windows builds
Status as of
Discovered by
Brotli bug: Khai Tran and Sylvie Mayer, OpenAI Codex Security (per the Node.js advisory and CVE record); TLS and DNS bugs: independent researchers

What changed with Node.js

On October 21, 2026, Node.js released 26.12.1, 24.22.1 and 22.23.4 to fix ten vulnerabilities. The most serious, CVE-2026-111497, sits in the Brotli decoder that Node.js bundles: malformed compressed input can write past an internal buffer, and Node.js says an attacker who can make an app decompress Brotli data with node:zlib could crash it, read process memory or run code. Google, which maintains Brotli, scores it 9.2 under CVSS 4.0 (critical) and released Brotli 1.2.1, 1.1.1 and 1.0.10. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 27, with a November 10 deadline for US federal agencies.

The same release fixes three more high-severity bugs: TLS hostname checks that could accept a certificate for the wrong IP address when the host is written with fullwidth digits (CVE-2026-105483) or with a leading zero such as 0127.0.0.1 (CVE-2026-106069), and NUL-character truncation in dns.resolve and dns.reverse (CVE-2026-105482). Six medium and low issues are also fixed, and Node.js notes that end-of-life lines are always affected. The Brotli bug is credited to Khai Tran and Sylvie Mayer of OpenAI Codex Security; the official advisories do not say what role AI played in finding it.

Brotli is embedded far beyond Node.js. OpenAI's Patch the Planet page lists fixed Bun 1.4.4, Envoy Proxy 1.40.0, 1.39.3, 1.38.6 and 1.37.8, and Istio 1.31.2, 1.30.6 and 1.29.9. Python brotli 1.2.1 and brotlicffi 1.2.1.0 are patched, Microsoft fixed .NET 8.0.33, 9.0.22 and 10.0.14 (self-contained and NativeAOT apps must be rebuilt), and PHP shipped Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, where the decoder is reachable through cURL automatic decompression. If you cannot patch right away, stop decoding untrusted Brotli data; for Next.js that guidance includes setting images.unoptimized until Node.js is updated.

How to fix it: Node.js

  1. 1. Update

    Update Node.js to 26.12.1, 24.22.1 or 22.23.4 (or later in the same line), then restart or redeploy every process that runs it.

    nodejs.org (opens in a new tab)

  2. 2. Update

    Update other software that bundles Brotli: Bun 1.4.4, a supported fixed Envoy Proxy or Istio release, Python brotli 1.2.1 or brotlicffi 1.2.1.0, and Brotli 1.2.1, 1.1.1 or 1.0.10 for native builds. Rebuild container images and static binaries.

    patchtheplanet.org (opens in a new tab)

  3. 3. Update

    On .NET, install 8.0.33, 9.0.22 or 10.0.14; rebuild and republish self-contained and NativeAOT apps.

    github.com (opens in a new tab)

  4. 4. Update

    On PHP for Windows, install the rebuilt packages 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1, which bundle Brotli 1.2.1.

    php.net (opens in a new tab)

  5. 5. Workaround

    Until patched, stop decoding untrusted Brotli data: reject Content-Encoding br before any parser, disable automatic Brotli decompression in HTTP clients, and in Next.js set images.unoptimized so the image optimizer stops fetching and decoding remote images.

    patchtheplanet.org (opens in a new tab)

  6. 6. Monitor

    CISA lists CVE-2026-111497 as known exploited. Prioritize internet-facing services and watch for unexpected crashes or unusual process behavior.

    cisa.gov (opens in a new tab)

Advisories

Where to compare Node.js

Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.

Why Node.js matters for businesses

Most AI products run Node.js somewhere: chat widgets, webhook receivers, MCP servers, agent back ends and Next.js front ends that fetch remote content. Any of them that accepts or fetches Brotli-compressed data from outside is in scope, and updating the operating system's Brotli package does not fix a runtime that bundles its own copy. Update every runtime and container image, restart or redeploy every worker, and confirm the version that is actually running, not just the one installed.

Sources for this story

  1. Wednesday, October 21, 2026 Security Releases (opens in a new tab)

    Node.js · nodejs.org

    Official
  2. Brotli v1.2.1 release (opens in a new tab)

    Google Brotli on GitHub · github.com

    Official
  3. CVE-2026-111497: Out-of-Bounds Write in Google Brotli Decoder (opens in a new tab)

    CVE Program · cve.org

    Official
  4. Known Exploited Vulnerabilities Catalog (opens in a new tab)

    CISA · cisa.gov

    Official
  5. Brotli vulnerability (CVE-2026-111497) (opens in a new tab)

    Patch the Planet (OpenAI) · patchtheplanet.org

    Official
  6. Microsoft Security Advisory CVE-2026-111497: .NET Brotli Decoder Out-of-bounds Write (opens in a new tab)

    Microsoft .NET · github.com

    Official
  7. Updated PHP Windows builds for Brotli security fix (opens in a new tab)

    PHP · php.net

    Official
  8. AL26-027: Critical vulnerability impacting Google Brotli (opens in a new tab)

    Canadian Centre for Cyber Security · cyber.gc.ca

    Official
  9. Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software (opens in a new tab)

    The Hacker News · thehackernews.com

    Press

Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.

  • #security
  • #cve
  • #nodejs
  • #brotli
  • #known-exploited
  • #supply-chain
  • #nextjs

Related news

Want this working in your business?

We turn new AI capabilities into agents, voice receptionists, and automations you can actually use.

Discuss your business projectSubmit an agency client project