Node.js October 2026 Security Release: Brotli CVE-2026-111497 & SRE Patch Guide

Originally published at Servermo

On October 21, 2026, the Node.js core maintainers released coordinated security updates addressing 10 vulnerabilities across active release lines. The headline flaw, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decompression library (deps/brotli).

SREs and system administrators must upgrade production environments to the patched versions: 26.12.1, 24.22.1, or 22.23.4. Node.js versions 20, 18, and 25 have reached End-of-Life (EOL) and will not receive upstream security fixes.

This is a runtime-level vulnerability. Because the vulnerable Brotli decoder, DNS resolvers, and TLS validation logic are compiled directly into the Node.js binary, updating your application's package.json dependencies will not mitigate the risk.

1. The Core Vulnerability: CVE-2026-111497

The Brotli decoder vulnerability is triggered when the runtime decompresses attacker-controlled Brotli data. Malformed compressed input forces the decoder to write outside its intended memory buffer.

The Node.js project rates CVE-2026-111497 as a High-severity memory-corruption vulnerability that can lead to a crash, process-memory disclosure, or remote code execution. Public research may differ in its assessment of practical exploitability, but the absence of a demonstrated production exploit does not establish that a vulnerable deployment is safe. Prioritize the official runtime update.

2. Inbound vs. Outbound Decompression Vectors

The Inbound Vector (Express 4 vs. Express 5)

Applications that accept attacker-controlled Brotli-encoded request bodies may be exposed if their middleware passes the payload to the vulnerable native decoder:

• Express 5: Utilizes body-parser ^2.3.0, where express.json() automatically inflates incoming request bodies tagged with Content-Encoding: br.
• Express 4: Relies on body-parser 1.x. The standard Express 4/body-parser 1.x path does not provide the same built-in Brotli request-body inflation support. This reduces exposure through that specific middleware path, but does not establish that the application is safe if custom middleware, direct node:zlib usage, or other Brotli-capable components process untrusted data.

The Outbound Vector (Undici & Fetch)

Applications using the built-in fetch() should assess whether responses from untrusted or compromised upstream services can reach the vulnerable Brotli decompression path. Outbound exposure depends on the runtime version, response encoding, and request-handling path. Inbound WAF rules alone do not address every outbound decompression scenario.

3. Beyond Node.js: Python and Bun Ecosystems

The underlying flaw exists in Google's Brotli library, affecting other ecosystems that bundle it:

• Python: The PyPI release notes indicate the brotlicffi package is patched in version 1.2.1.0 (which incorporates the underlying libbrotli v1.2.1 fix), and the brotli package is patched in version 1.2.1. Verify that compatible wheels are available for your deployment platform.
• Bun: Bun releases up to 1.4.3 bundle an affected Brotli decoder. The project has addressed this security flaw in the Bun 1.4.4 release.

4. TLS, DNS, and Cryptographic Failures

The October 2026 release resolves 9 additional vulnerabilities. Ensure your infrastructure patching accounts for these critical networking and cryptographic fixes:

• eMudhra CA Trust Store Update: Updates the bundled CA trust data (NSS 3.131.1) and rejects certificate chains containing specifically blocked public keys associated with the eMudhra intermediate CA compromise. Deployments using custom trust stores should independently verify their certificate-validation configuration.
• TLS Hostname Verification Bypasses:
  • CVE-2026-105483 (High): Bypasses certificate checks when an IP address is written using fullwidth Unicode digits (Affects 24.x, 26.x).
  • CVE-2026-106069 (High): Bypasses certificate validation when hostnames resolve loosely to non-canonical IPv4 representations (Affects 22.x, 24.x, 26.x).
  • CVE-2026-106072 (Medium): A distinct TLS issue where DNS Subject Alternative Names (SANs) improperly authenticate non-canonical IPv4 endpoints (Affects 22.x, 24.x, 26.x).
• The SEA Crypto Entropy Bug (CVE-2026-106074 - Medium): When a snapshot or Single Executable Application (SEA) is built, calls to crypto.randomUUID(), crypto.randomUUIDv7(), crypto.randomInt(), or APIs that rely on these caches can preserve entropy-cache state in the snapshot. Processes started from that snapshot may repeat cached values until the cache is refilled (Affects 22.x, 24.x, 26.x).
• CVE-2026-105482 (High): dns.resolve*() and dns.reverse() truncate hostnames containing NUL characters. This allows an attacker to bypass domain allowlist validations (Affects 22.x, 24.x, 26.x).
• CVE-2026-105481 (Medium): HTTP keep-alive socket accepts a response preceding the request (Affects 22.x, 24.x, 26.x).
• CVE-2026-106073 (Low): Permission Model bypass through fs.realpathSync (Affects 22.x, 24.x, 26.x).
• CVE-2026-106070 (Low): zlib.ZipFile returns an attacker-controlled prefix after validation failure (Affects 26.x).
• CVE-2026-106071 (Low): Wildcard radix lookup over-grants filesystem permissions in the Permission Model (Affects 26.x).

5. SRE Playbook: Docker & Container Workloads

Updating your host OS via apt-get does not patch Node.js runtimes isolated inside Docker containers. You must explicitly pin the patched base image version in your Dockerfile (e.g., node:24.22.1-alpine).

To prevent the reuse of stale, vulnerable image layers, fetch the latest updates using --pull. If you suspect stale caching, utilize --no-cache:

docker build --pull --no-cache -t your-api:latest .

A successful build does not guarantee the patched version is active. Verify the runtime version inside the newly built image:

docker run --rm your-api:latest node -v

Push the new image digest to your registry and trigger a rolling restart across your deployment to replace active pods.

6. SRE Playbook: Bare Metal, PM2, and Systemd Path Traps

Installing the new binary via Node Version Manager (NVM) does not automatically protect your application. Executing nvm alias default 24.22.1 changes the path for new terminal sessions, but running PM2 daemons and systemd units often hardcode the absolute path of the old executable.

To securely patch host-level processes:

1. Install the patched runtime:

   nvm install 24.22.1
   

2. Verify the new path in your shell:

   node -v && command -v node
   

3. Check your PM2 ecosystem configuration files for any hardcoded interpreter paths.

4. Restart applications with the updated environment:

   pm2 restart all --update-env
   

5. Update the PM2 daemon itself:

   pm2 update
   

6. Regenerate systemd startup scripts:

   pm2 unstartup
   pm2 startup
   

   Inspect the ExecStart and Environment directives in the resulting /etc/systemd/system/ unit files to ensure they point to the patched binary.

7. Running Node.js Executable Inventory via /proc

Process names in top or htop can be deceptive. A process might be named next-server while silently running an outdated Node.js binary. To inventory the actual executables loaded into memory on a Linux host, inspect the kernel's process tree:

for d in /proc/[0-9]*; do
  exe=$(readlink "$d/exe" 2>/dev/null) || continue
  case "${exe% (deleted)}" in */node|*/nodejs) ;; *) continue ;; esac
  printf '%-8s %-70s\n' "${d#/proc/}" "$exe"
done

⚠️ Inventory Limitations: If the output appends (deleted), the process is executing a replaced inode and requires a hard restart. However, an output lacking (deleted) (e.g., /usr/bin/node) does not definitively prove the process is patched. Use this inventory check in conjunction with deployment metadata, image digests, and planned restarts to verify runtime remediation.

Node.js Patching & Operational FAQ

Will Node.js 20 or 18 receive a patch for CVE-2026-111497?

No. Node.js 20 and 18 are End-of-Life (EOL). Upstream maintainers do not provide security updates for EOL branches. You must migrate to the 22.x or 24.x Active LTS lines or utilize a commercial Extended Lifecycle Support (ELS) vendor.

Does turning off Brotli on the CDN remove the Node.js risk?

No. Disabling Brotli compression at the CDN or reverse proxy only restricts inbound client requests. It does not patch the runtime binary, leaving internal microservices, background jobs, webhooks, and outbound fetch() calls to third-party APIs fully exposed. Upgrade the Node.js runtime even if inbound Brotli requests are restricted.

Does updating NVM automatically restart PM2 applications with the patched Node.js binary?

No. Running NVM commands only changes default paths for new shells. Running PM2 daemons and systemd unit files store the absolute path to the binary. You must execute pm2 restart all --update-env, update the PM2 daemon with pm2 update, and regenerate systemd startup units.