Node.js Brotli RCE: CVE-2026-111497 patch and exposure guide

Sources checked: 29 October 2026. This article contains FailSafe's analysis and proposed validation workflow; linked sources support the reported facts.

The Node.js October 21 security release addresses ten vulnerabilities, including CVE-2026-111497 in the bundled Brotli decoder. The important application question is whether untrusted compressed input can reach the affected decoder. Runtime version alone does not describe every service's attack surface.

What did Node.js fix?

Node.js describes an out-of-bounds write that can corrupt process memory when an application decompresses attacker-supplied Brotli data through node:zlib. Potential consequences include a crash, memory disclosure, or remote code execution. The project rates this issue High and lists release lines 22.x, 24.x, and 26.x as affected. The October fixes are 22.23.4, 24.22.1, and 26.12.1 respectively; use a current supported release that includes them. Source: Node.js security release.

Which application paths should teams review?

Start with the places where your service accepts compressed content or retrieves responses from another system. Review request processing, webhook consumers, content importers, proxy services, document pipelines, and background ingestion jobs. Inspect the actual library configuration and data flow instead of assuming every HTTP endpoint performs Brotli decompression.

The same application may run different Node.js versions in a web container, a serverless function, a build runner, and a queue worker. An updated developer laptop does not establish that production is fixed. Likewise, a clean package lockfile does not describe the runtime embedded in a managed image.

A practical remediation sequence

1. Identify the deployed runtime. Record version and image provenance for each service, including dormant jobs and preview environments. Use the hosting provider's guidance where it manages the runtime.
2. Map untrusted input. Document whether a third party can influence compressed bytes, which process decodes them, and which credentials or data that process can access.
3. Rebuild and roll out. Update the base runtime, rebuild reproducible artifacts, deploy all replicas, and verify the running result. Keep rollback artifacts from restoring a known vulnerable runtime.
4. Check behavior after the update. Use safe regression fixtures for legitimate compressed content and malformed-input handling. Keep potentially disruptive vulnerability reproduction in an isolated environment with written authorization.

Why this is also an API security problem

Compression sits inside a larger trust boundary. A worker that fetches user-selected resources might also need destination restrictions, bounded response sizes, timeouts, and limited network access. A decompression fix cannot establish whether those application controls work. Review them as separate requirements with separate evidence.

For application and API penetration testing, a useful scope describes the caller, accepted formats, upstream dependencies, permissions, and allowed failure modes. This lets a security team test the deployed workflow without treating a list of CVEs as a complete assessment.

What to measure after remediation

Track remaining vulnerable instances, unknown runtime owners, completed deployment verification, and regression failures. Preserve relevant crash and process telemetry for the incident team if suspicious activity is found. Absence of a crash in a short test does not prove that a service was never vulnerable.

FailSafe SWARM supports authorized testing across configured application and API scopes. Review the agentic pentesting buyer guide to evaluate evidence and limits, or explore the first pentest offer for businesses.