Node.js Patches a Critical RCE Flaw in Its Brotli Decoder

Node.js shipped a batch of security releases on October 21, 2026, covering all three maintained branches at once: 22.x, 24.x, and 26.x. The most serious flaw sits in the Brotli decoder and allows remote code execution. The release also closes several TLS validation bypasses, making it one of the densest security updates of the year for teams running Node.js in production.

#Remote code execution through the Brotli decoder

The headline vulnerability, tracked as CVE-2026-111497 and rated high severity, stems from a flaw in Node.js’s built-in Brotli decoder. A specially crafted Brotli stream can trigger an out-of-bounds write, a classic bug class that opens the door to arbitrary server-side code execution. The issue was reported by OpenAI Codex Security along with researchers Khai Tran and Sylvie Mayer, and fixed by maintainers Matteo Collina and Antoine du Hamel.

Any service that decompresses untrusted Brotli content should treat this flaw as top priority. The zlib.brotliDecompress function and its synchronous counterparts are directly affected.

#TLS: several bypasses closed in the same release

The same release closes three TLS validation flaws. Two of them let an invalid hostname pass as valid, one via fullwidth digits in a certificate, the other when a hostname loosely resolves to an IP address. A third fix addresses certificate validation for non-canonical IPv4 addresses. These issues touch the same TLS trust chain that Node.js already reworked in September, with refreshed NSS roots and OpenSSL. Other fixes, rated medium to low, cover keep-alive socket reuse, repeated values from crypto.randomUUID(), and two Permission Model bypasses specific to the 26.x branch.

#Affected versions and upgrade path

All three maintained branches are affected, which rules out dodging the issue with a minor version bump. An application still running an end-of-life branch stays vulnerable with no fix coming, Brotli flaw included. Checking the running version and upgrading remains the only response the Node.js team recommends.

# Check the active version
node --version

# With nvm, install and activate the patched version for your branch
nvm install 24.22.1
nvm alias default 24.22.1

# On a systemd deployment, rebuild and reload the service
npm ci --omit=dev
sudo systemctl restart my-app.service

A crafted Brotli input can trigger an out-of-bounds write capable of leading to remote code execution, across all three currently maintained branches of Node.js.

#What this means for teams running Node.js

The density of this release, six CVEs at once including a high-severity RCE, is a reminder that a runtime’s attack surface goes well beyond application code. Teams running a Node.js deployment in production behind systemd and a reverse proxy are better off automating version rollout than handling it manually on every announcement. The TLS fixes in this release also echo the TLS chain refresh Node.js shipped in September, proof that this work is still ongoing.

#Key takeaways

Node.js 22.23.4, 24.22.1, and 26.12.1 fix a critical RCE flaw in the Brotli decoder along with several TLS bypasses. The update applies to every active installation, including those running recent LTS releases shipped just days earlier, such as 24.22.0 from the previous week. End-of-life versions remain vulnerable with no fix to expect.

Further reading: the full security advisory, with the detailed list of CVEs fixed per branch, is available on the official Node.js blog.