Research

Node.js Fixed a Brotli Bug That Can Lead to Code Execution. If Your Code Fetches Untrusted URLs, Patch It First.

Patrick Duggan · · 2 min read

Node.js Fixed a Brotli Bug That Can Lead to Code Execution. If Your Code Fetches Untrusted URLs, Patch It First.

Node.js shipped security releases on October 21 that fix ten flaws. The one to act on is CVE-2026-111497: an out-of-bounds write in Node's Brotli decoder that the project says can lead to remote code execution. It affects every supported line. Upgrade to 22.23.4, 24.22.1 or 26.12.1. If you are on Node 20, 23 or 25, there is no fix for you, and moving to a supported line is the patch.

Node.js Brotli decoder RCE, CVE 2026 111497, high severity, all supported lines 22, 24 and 26, fixed October 21, 2026, reported by OpenAI Codex Security. Where attacker supplied Brotli reaches the decoder, our reading since the advisory names no code path: a server you fetch from answers with Content Encoding br (scrapers, webhooks, link previews, feed harvesters, AI agent fetch tools), or a client posts a Brotli compressed body to an endpoint that inflates it. Public reports say a crash has been demonstrated and code execution is still being worked on. What to do: upgrade to 22.23.4, 24.22.1 or 26.12.1 and rebuild container images; get off Node 20, 23 and 25, which get no fix; patch processes that fetch untrusted URLs first.

What is known

  • The flaw. The advisory calls it "Node.js Brotli decoder out-of-bounds write permits remote code execution," rated high. It was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security.
  • What is not known. The advisory does not say which API or code path is the trigger, gives no CVSS score and lists no workaround.
  • Exploitation. Secondary reporting says a researcher has a version that crashes services and is still working on code execution. Nobody has reported attacks in the wild. It is not in CISA's Known Exploited Vulnerabilities catalog as of the October 21 edition.
  • The rest of the release. Three more high-severity fixes are about TLS hostname checks and DNS name handling (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069). If you rely on Node to check certificates by hostname, those matter too.

Who should move first

Brotli data has to come from somewhere, and the attacker has to control it. Our reading of where that happens, which the advisory does not confirm:

  • Anything that fetches URLs it does not control. A hostile server can answer with Brotli-compressed content. That covers scrapers, webhook senders, link previews, RSS and feed readers, and the fetch tools that AI agents use to read web pages.
  • Anything that accepts compressed uploads. An endpoint that inflates a Brotli-compressed request body is taking the bytes straight from the client.

Patch those processes first, and assume the agent tooling on developer laptops counts.

What we checked on ourselves

We fetch hostile servers for a living: our harvesters and probes request pages from attacker infrastructure every day. So we checked before writing this. Both production containers run Node 22.23.4, the fixed version, because their images were rebuilt on October 22. That was timing, not foresight: the base image tag floats to the latest patch release, and it only helps when you rebuild. One development laptop runs Node 25, which gets no fix. Moving it to a supported line is the next change on our list.

The advisory, the full list of ten fixes and the downloads are on nodejs.org: Node.js October 21, 2026 security releases.

If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=node-js-fixed-a-brotli-bug-that-can-lead-to-code-execution-if-your-code-fetches-untrusted-urls-pat