Node.js fixes 10 vulnerabilities, one with RCE in Brotli: update today

On 21 October 2026 the Node.js project published security releases for the 22.x, 24.x and 26.x lines. They fix 10 vulnerabilities. The most serious is CVE-2026-111497: an out-of-bounds write in the Brotli decoder that allows remote code execution.

An important nuance: the official advisory rates the worst issue as High severity, not "critical", and mentions no critical issue. Even so, an RCE in a library that processes network data deserves an update as soon as possible.

Patched versions

Versions that have already reached end of life are also affected and will not get a patch.

The 10 vulnerabilities

The release also updates bundled dependencies: c-ares, Undici, OpenSSL (22.x and 24.x), SQLite (22.x) and a root certificate change due to the compromise of an intermediate CA (eMudhra).

Why Brotli matters

Brotli is a compression format that web servers and APIs use routinely. Node ships it inside the binary itself, so updating a Brotli library on your operating system is not enough: you need the new Node binary.

According to third-party analyses of the advisory, fetch() and Express 5 decompress Brotli automatically, which makes the vulnerable code easier to reach when your application processes data it does not control, such as responses from external APIs. The official advisory describes the flaw in a single line, so it is best not to assume more than what has been published. No attacks have been reported so far, but the window between a patch and exploitation tends to be short.

How to update

1. Check your version: node -v on the server and, if you use containers, the tag of your base image.
2. nvm or fnm install: nvm install 24 (or the line you use) and nvm alias default 24.
3. Docker: update FROM node:24 to a rebuilt image (node:24.22.1) and rebuild without cache.
4. Managed platforms (Vercel, Railway, Render…): confirm your project uses the latest minor version of your line; on most it is set in the project settings.
5. Restart the processes (PM2, systemd, containers). A running process keeps using the old binary in memory.
6. If you use startup snapshots or SEAs (Single Executable Applications): regenerate them with the new version because of CVE-2026-106074; updating the binary is not enough.
7. Run your tests and check that npm audit reports nothing new.

If you are still on an unsupported line (for example Node 18 or 20), take the chance to move to 24 LTS: the patch will not reach those versions.

What else to check

• That outgoing calls always verify the TLS certificate and do not disable validation (rejectUnauthorized: false).
• That you do not rely on the Permission Model as your only security barrier until you update.
• That your CI pipeline installs a pinned version and not an uncontrolled "latest".

References

• Node.js Security Releases: October 21, 2026 (official advisory)
• All Node.js security advisories
• Node.js release schedule
• Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) (Vercel)
• Node.js October 2026 Security Releases (CloudLinux)

Is your Node.js application running on a server nobody reviews? At Codegea we audit your Node version, update and rebuild your deployment and set up ongoing maintenance and monitoring so you do not depend on hearing about it in the news. Tell us about your case.