Node.js Brotli Vulnerability (CVE-2026-111497): What to Check on Your Servers

If your website, shop or app runs on Node.js, one update deserves your attention this week. On October 21, 2026, the Node.js team released security versions that fix a serious flaw in Brotli, the compression library behind many "br" responses on the web. The flaw is tracked as CVE-2026-111497, and it has already been added to the US CISA list of known exploited vulnerabilities. The fix is a normal update. This post explains what is affected and gives you a short list to work through.

What happened

Brotli is a compression format created by Google. Browsers, servers and many programming tools use it to shrink data. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, the part that unpacks compressed data. If an application decompresses Brotli data that an attacker controls, the result can be a crash, a leak of memory contents or, in the worst case, running the attacker's code.

The score is high. Google's CVSS 4.0 rating is 9.2, and the NVD CVSS 3.1 rating is 9.8. Some write-ups call it Node2Shell. A public proof of concept exists, and security researchers have reported exploit traffic aimed at Node.js servers. Reports describe the observed attempts crashing the process rather than taking over the machine, but nobody should wait to see how that develops.

Which versions are affected

Node.js fixed the problem in these releases:

• Node.js 22.23.4
• Node.js 24.22.1
• Node.js 26.12.1

Older builds on those three lines are affected. The end-of-life lines, 20.x, 23.x and 25.x, are also affected and will not get a fix, so they need to move to a supported version.

The Brotli library itself is fixed in 1.0.10, 1.1.1 and 1.2.1. Other software that bundles Brotli has its own updates. Tenable lists .NET, Bun, Envoy Proxy, Istio, FFmpeg, Apache Arrow and ClickHouse as products to review, and Python's brotli packages have fixed versions too. If you are unsure whether you use any of these, ask your host or developer.

Check 1: Find out where Node.js runs for you

Node.js is easy to forget. It may power your main app, but it also hides in build tools, API servers, headless front ends, scheduled jobs and CI runners. Make a short list of every place it runs. A standard WordPress site on PHP is not running Node.js for its pages, but the tools around it sometimes are.

Check 2: Update to a fixed release

Run node --version on each machine and compare it to the fixed versions above. If you are behind, update to the latest release on your line, then restart the service. On a managed host, check whether your hosting panel lets you choose the Node.js version and pick the newest patch of a supported line.

Check 3: Do not forget containers and build images

An updated server does not help if your container image still has the old runtime inside. Rebuild images from a fresh base, redeploy, and check the version on the running workload, not only in your build files. The same goes for CI runners and any bundled Node.js binary inside a desktop or command-line tool you ship.

Check 4: Updating packages is not the same as updating Node.js

One point from the technical write-ups is worth repeating: upgrading npm packages such as Express does not fix this flaw. Only a patched Node.js release does. Keep that in mind if your dependency tool shows everything as up to date.

Check 5: Limit untrusted Brotli input until you are patched

If you cannot update right away, you can reduce exposure. The risk depends on whether your app decompresses Brotli data from people you do not trust, such as request bodies or responses fetched from outside services. For incoming request bodies, the body-parser option inflate: false helps, though it does not cover responses your server fetches itself. A web application firewall rule can buy a little time, but treat it as a stopgap only.

Check 6: Look back at what was exposed

If an internet-facing Node.js service accepted compressed request bodies before you patched, look through your logs for crashes and restarts around late October. A sudden process crash on a service that was stable before is worth a second look.

A short checklist

• Every place Node.js runs is listed
• Each one is on 22.23.4, 24.22.1, 26.12.1 or newer
• End-of-life versions (20.x, 23.x, 25.x) are scheduled for an upgrade
• Containers and CI images rebuilt and redeployed
• Services restarted and the running version confirmed
• Other Brotli users (.NET, Bun, Python packages) reviewed
• Logs checked for unexplained crashes

Why this one matters

Compression bugs are a good reminder that the quiet parts of a stack matter as much as the visible ones. Nothing here asks for a rebuild of your site. It asks for one tidy afternoon: find the runtimes, update them, restart them and confirm the version. CISA gave US federal agencies until November 10 to finish their fixes, which is a sensible deadline for everyone else to aim for as well.

For more practical website guides, visit expertwebdeveloper.in and growsmartwithai.com.

Sources

• Cyber Security Agency of Singapore: Active Exploitation of Critical Brotli Vulnerability Affecting Multiple Products
• Tenable: CVE-2026-111497
• Help Net Security: Brotli bug reaches far beyond Node.js (CVE-2026-111497)
• Rescana: Node.js CVE-2026-111497 Node2Shell Brotli RCE, October 2026