CVE-2026-111497: The Node.js Brotli Bug That Turns Your Server's fetch() Into an Attack Surface

On 21 October 2026, the Node.js project shipped security releases for every supported line: 22.23.4, 24.22.1 and 26.12.1. They fix ten vulnerabilities. The one getting the attention is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that, in the project's own words, "permits remote code execution."

It landed the same day as the PHP2Shell patches, so it was easy to miss. It shouldn't be. Node.js runs a huge share of modern backends, API gateways, serverless functions and AI tooling, and this bug sits on a path most teams never think of as input: the responses their own server downloads.

At a glance

• CVE: CVE-2026-111497
• Severity: High (Node.js did not publish CVSS scores for this release)
• Bug: Out-of-bounds write in the Brotli decoder bundled with Node.js
• Impact: Remote code execution with the permissions of the Node.js process, per the advisory. Vercel says researchers demonstrated memory disclosure and command execution on unpatched versions.
• Affected: Node.js 22.x, 24.x and 26.x, and all end-of-life lines
• Fixed: 22.23.4, 24.22.1, 26.12.1
• Reported by: Matteo Collina. Fixed by Antoine du Hamel, using an upstream Brotli commit.
• Exploitation: None reported as of 22 October 2026
• Workaround: None. Upgrade the runtime.

What Brotli is, and why a decoder bug is serious

Brotli is a compression format, the br you see in Content-Encoding headers. Browsers and CDNs use it everywhere because it compresses web content better than gzip. Node.js ships a Brotli decoder in its zlib module, and its built-in fetch() uses it automatically.

A decoder takes a small compressed input and writes out a much larger result. If it can be tricked into writing past the end of its output buffer, an attacker controls bytes landing in memory they should never touch. That is what an out-of-bounds write is, and it is the classic starting point for code execution in native code. Node.js has not published the technical details, which is normal for a fresh fix.

How attacker data reaches the decoder

Node.js does not decompress Brotli on its own. The bug is reachable when your code, or a library you use, decodes Brotli data that an attacker controls. There are two ways that happens.

The two ways attacker-controlled Brotli data reaches the vulnerable decoder

Outbound: your server fetches something

This is the important one. Node's built-in fetch() (undici) automatically decompresses a response when the server replies with Content-Encoding: br. Testing published by lilting.ch shows that decision depends only on the response header, and that sending Accept-Encoding: identity does not stop it: a hostile server can reply with Brotli anyway.

So the question is not "do we accept compressed uploads?" It is "does our server ever fetch a URL someone else chose?" Features that do exactly that are everywhere:

• link previews and unfurling
• webhooks and callback URLs
• "import from URL" and RSS or feed readers
• image proxies and thumbnailers
• scrapers, SEO and uptime checkers
• AI agents and tools that browse or fetch pages

Every one of those lets an outsider pick the server your code talks to, which means they pick the response, too.

Inbound: you decompress what users send

If your application or a middleware decompresses Brotli request bodies, a client can send malicious data directly. Vercel deployed WAF rules on 21 October to block this inbound vector for its customers, but notes they do not cover responses your functions fetch from other servers. A WAF in front of you cannot see what your server downloads.

The rest of the release

CVE-2026-111497 is one of ten fixes. Several matter on their own:

The ten vulnerabilities fixed in the October 2026 Node.js security release

• Two TLS hostname bypasses (High). CVE-2026-106069 and CVE-2026-105483 let a certificate match an IP address it was not issued for when the IP is written in an unusual form, such as fullwidth digits or a spelling that loosely resolves to an IP. Exploiting them needs a certificate from a trusted CA, so they are harder to use, but they undermine the check TLS exists to do.
• DNS NUL truncation (High). CVE-2026-105482: dns.resolve cut names at a NUL character, so a lookup for example.com\0.trusted.corp actually queried example.com. Anything that validates a hostname and then resolves it could be fooled.
• Repeated "random" values (Medium). CVE-2026-106074: applications built from a startup snapshot or as a single executable could produce the same crypto.randomUUID() and randomInt() values in every process.
• eMudhra certificates removed. The release updates Node's bundled CA certificates to distrust the compromised eMudhra intermediates. Since Node does not check revocation by default, this is how Node applications actually stop trusting them.

Who should worry most

• Anything that fetches user-supplied URLs. That includes link preview services, webhook senders, scrapers and AI agents with web tools. Patch these first.
• Services that decompress request bodies, whether in your own code or in middleware.
• Anything on an end-of-life line. Node.js 20 and 25 are end of life and get no fix. EOL versions are "always affected" by a security release, as the project puts it. Vercel is telling customers on Node.js 20 to move to 22 or 24 and redeploy.
• Pinned container images. A node:22 image built last month still contains last month's Node. Rebuild, don't just restart.

What to do

1. Find every Node.js runtime, not just your main app: API servers, workers, cron jobs, serverless functions, CLI tools in CI, Electron apps, and container base images.
2. Upgrade to 22.23.4, 24.22.1 or 26.12.1. Updating npm packages does not update Node itself.
3. Rebuild and redeploy containers from a fresh base image, then restart long-running processes. A running process keeps the old runtime in memory.
4. Move off Node.js 20 and 25. They will not be patched.
5. On managed platforms, check your provider's status. Vercel says it is rolling patched versions across its managed runtimes for 22.x and 24.x, and that external backends behind Vercel still need upgrading themselves.
6. Reduce what a fetch can do, whatever the version: run URL-fetching features in a separate service with no secrets, restrict outbound network access, and treat every fetched response as hostile input.
7. Check for crashes. A failed attempt at memory corruption often crashes the process. A run of unexplained Node.js crashes in a service that fetches external URLs is worth investigating.

The takeaway

We spend a lot of effort guarding the front door: request validation, WAFs, rate limits. CVE-2026-111497 is a reminder that a server also opens the door every time it fetches something, and that the response is just as much attacker input as a request body. With more and more software handing URLs to AI agents to go and read, that door is open more often than it used to be.

Patch the runtime, rebuild the images, and take a hard look at every feature that lets a stranger tell your server where to fetch from.

This article reflects public information as of 22 October 2026. It will be updated if Node.js publishes technical details or exploitation is reported.

Sources

• Node.js: Wednesday, October 21, 2026 security releases (official advisory)
• Node.js: Node.js 22.23.4 (LTS) release notes
• Vercel: Node.js security advisory, Brotli decoder RCE (CVE-2026-111497)
• lilting.ch: Node.js v24.22.1 fixes four HIGH CVEs, tested against v24.22.0 and EOL v25.3.0
• Cyber Kendra: Node.js patches Brotli RCE flaw, 9 other vulnerabilities
• Cyber Security News: Node.js releases security updates to fix high-severity TLS, DNS and Brotli vulnerabilities
• LFW: We ran an affected version, patched it and found no sign of exploitation
• Node.js: End-of-life versions