Node.js October 2026 Security Release: Check and Patch the Brotli RCE

On October 21, 2026, the Node.js project released security fixes for all supported release lines: 22.x, 24.x and 26.x. The release fixes 10 vulnerabilities. Four are rated high, and one of them can lead to remote code execution.

What's affected

The most serious issue is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that ships with Node.js. In the advisory's words: "An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution."

You're exposed if your app decompresses Brotli data that someone else controls, such as compressed uploads, request bodies, or responses from servers you don't trust. Libraries can call node:zlib for you, so not calling it in your own code doesn't rule you out.

The same release also fixes:

• two TLS certificate hostname bypasses (CVE-2026-105483, CVE-2026-106069);
• a DNS name truncation bug (CVE-2026-105482);
• six medium and low issues.

It updates OpenSSL, c-ares, SQLite and Undici, and updates its CA certificates after the eMudhra intermediate CA compromise.

Fixed versions

• Node.js 26 (Current): upgrade to 26.12.1
• Node.js 24 (LTS): upgrade to 24.22.1
• Node.js 22 (LTS): upgrade to 22.23.4

There's no workaround in the advisory: upgrading is the fix. End-of-life versions get no patch. The advisory says, "End-of-Life versions are always affected when a security release occurs," so if you're on Node.js 20 or older, plan the move to 22 or 24 now.

How to check your app

1. Find the version you actually run. It's not necessarily the one on your laptop. Print process.version at startup, or run node -v inside your container image.
2. Look for Brotli decompression: zlib.createBrotliDecompress, zlib.brotliDecompress and their sync versions. Also look for HTTP clients or middleware that decompress br content for you.
3. Upgrade and redeploy, even if you find no Brotli path. Three of the other high-severity fixes are in TLS and DNS handling, which almost every app uses.

Updating on ComputeSphere

• Deploying from your own Dockerfile: update the base image. For example, change FROM node:24-slim to a patched tag such as node:24.22.1-slim. Pinning the exact version makes the patch explicit. Push, and the new build deploys.
• Deploying from source without a Dockerfile: builds use the Node.js version saved in your service's build settings. When you create a service, it's taken from engines.node in your package.json. Node.js 22 builds run 22.23.4 and Node.js 24 builds run 24.22.1, so redeploy to pick up the fix. On Node.js 18 or 20, which are end-of-life with no fix, change the version in your service's build settings to 22 or 24 and redeploy.
• Either way, check the build log for the Node.js version that was installed, and confirm process.version in your logs after the deploy.

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases
• Node.js release notes: v22.23.4, v24.22.1, v26.12.1

Last checked October 23, 2026.