First 24 hours with CVE-2026-111497: an incident-response runbook for Node.js fleets
First 24 hours with CVE-2026-111497: an incident-response runbook for Node.js fleets The alert has arrived, the severity is 9.8 in one source and high in another, and the change freeze is real. What follows is a defens
First 24 hours with CVE-2026-111497: an incident-response runbook for Node.js fleets
The alert has arrived, the severity is 9.8 in one source and high in another, and the change freeze is real. What follows is a defensible sequence for the first day, built around the facts in the Node.js advisory rather than around the score.
Hour one: decide reachability, not severity
The defect is a Brotli decoder out-of-bounds write reachable through node:zlib. The precondition is that an affected application decompresses attacker-controlled Brotli data. So the first hour produces one artifact: a list of services that inflate Brotli input from an untrusted source.
Ask each service owner three questions. Does the service accept Content-Encoding: br or call the Brotli decoder on external data. Is the runtime on line 22.x, 24.x or 26.x below the fixed release. What would an attacker gain from code execution in that process.
Services that answer the first question with no are closed for this CVE with a documented reason. That is not a shortcut; it is the same logic the advisory uses.
Hour two to six: patch the reachable set
Fixed releases are 22.23.4 for line 22.x, 24.22.1 for line 24.x and 26.12.1 for line 26.x. End-of-life branches will not receive a fix and should be treated as permanently affected.
Two traps appear here regularly. A container rebuilt on an unchanged base image can still ship the vulnerable decoder, so the verification step has to read the runtime version from the running process. And a vendored Brotli library needs its own update: the CVE record names 1.0.3 through 1.2.0 in c/dec/decode.c, fixed in 1.0.10, 1.1.1 and 1.2.1.
Hour six to twelve: interim controls where patching waits
Where a reachable service cannot be patched immediately, three controls reduce the blast radius without pretending to fix the bug.
Reject Brotli request bodies on endpoints that never needed them, at the edge if possible.
Cap compressed and expanded size before inflation, so a malformed stream cannot push the decoder through repeated continuation rounds.
Move inflation into a worker with no database credentials and no outbound network access, converting a potential code execution into a restart.
None of these is a substitute for the upgrade, and none should be recorded as remediation.
Hour twelve to twenty-four: check for prior exploitation
Because the crash consequence is the loudest, review process exits that followed requests carrying compressed bodies. Where Content-Encoding is not logged, that query cannot be written, which is itself a finding to fix.
For memory disclosure, look for decoder error paths that return internal detail to clients. For code execution, look for outbound connections or child processes from decoding workers. Absence of evidence here is not evidence of absence, and the runbook should say so.
What the advisory adds beyond the CVE
The same October 21, 2026 release fixes nine other issues across the runtime, including DNS name truncation, three TLS hostname verification bypasses and a keep-alive response ordering flaw. Ship them together. A hotfix that patches only the Brotli identifier will leave a fleet with an inconsistent version baseline and a second change window nobody planned.
Close-out criteria
An incident can be closed when every reachable service runs a fixed release, every vendored decoder meets the version floor, image rebuilds are verified from inside the process, and the remaining services have a documented reason for being out of scope.
The defect was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security and fixed by mcollina and aduh95. For responders, the useful discipline is to write the reachability list before touching the patch queue.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.