Skip to content

Node.js patches a Brotli decoder RCE across every supported line

Today's security release fixes ten vulnerabilities, four of them high severity, including a remote code execution bug in Brotli decompression.

Source: Node.js

Node.js shipped its pre-announced security release on 21 October, patching 22.x, 24.x and 26.x. The fixed versions are v22.23.4, v24.22.1 and v26.12.1.

Ten vulnerabilities are fixed in total: four rated high, three medium, three low. The one to act on first is CVE-2026-111497, an out-of-bounds write in Node’s Brotli decoder that permits remote code execution. The other high-severity fixes cover a dns.resolve bug that truncates names containing a NUL character, and two separate TLS certificate hostname bypasses, one involving fullwidth digits and one involving loose IP resolution. The release also bundles updated c-ares, OpenSSL, Undici and SQLite dependencies, plus a new CA certificate bundle following the eMudhra intermediate CA compromise.

Why it matters: this reaches every currently supported Node line at once, and the Brotli bug is a remote code execution flaw in a decompression path that most HTTP-facing code exercises without knowing it. There’s no reasonable way to avoid the update path here: upgrade to the patched point release on whichever line you run.

The caveat: end-of-life Node versions do not get this fix. If you’re still on one, this release doesn’t reach you.

Share

Related reading

Engineering

How to patch PHP in a hurry without breaking production

PHP ships an out-of-band fix for two critical flaws at 14:00 UTC today. Here is the hour of preparation that turns the patch into a non-event, and the runbook for when it lands.

ML for Web Devs

Machine learning for web developers: the only mental model you need

You do not need calculus to work with models. You need one idea, that a model is a function you fit instead of write, and the rest follows from things you already know.

Web

View transitions without a framework

Animating between two states used to mean keeping both in the DOM and choreographing them by hand. The browser will now do the hard part for you, in about six lines.

More from The Wire

All briefs

Next.js 15 reaches end of life today

Two years after its release, Next.js 15 stops receiving even critical bug fixes and security updates. Vercel recommends moving to 16, which is in Active LTS.

via Next.js