Node.js October 2026 Security Emergency: Brotli RCE (CVE-2026-111497) & TLS Validation Bypass

The scheduled October 2026 security releases for the Node.js project represent one of the most consequential runtime updates of the year for the server-side JavaScript ecosystem. At the center of the bulletin is CVE-2026-111497, a Critical (CVSS 9.8) out-of-bounds write vulnerability inside the Brotli decoder bundled directly into the core node:zlib module and the built-in HTTP client (undici / fetch).

Because virtually every modern web architecture relies on Brotli compression (Content-Encoding: br) to accelerate JSON payloads and static assets, the blast radius spans millions of backend services, API gateways, and SSR frameworks including Astro, Next.js, and Nuxt.

Anatomy of CVE-2026-111497: Out-of-Bounds Write in the Brotli Decoder

CVE-2026-111497 stems from a bounds-checking failure when the Brotli decoder processes specially crafted Huffman distance tables inside compressed blocks. When a Node.js application decompresses a Brotli stream originating from an untrusted external source, an attacker can trigger memory writes past the allocated V8/Node.js heap buffer.

“Any Node.js service that directly calls zlib.brotliDecompress(), zlib.createBrotliDecompress(), or automatically decompresses HTTP responses via native fetch() against untrusted external endpoints is exposed to heap corruption and potential remote code execution (RCE).”

Real-World Exploitation Vectors

Three primary attack surfaces make this flaw particularly dangerous in production environments:

1. Webhook & API Ingestion Accepting Compressed Payloads: Express, Fastify, or Hono servers configured to automatically decompress incoming POST/PUT requests carrying Content-Encoding: br.
2. SSR & Scraper Backends (fetch / undici): Applications that fetch user-supplied URLs—such as link preview generators, RSS aggregators, or AI web-browsing agents. Because native fetch() sends Accept-Encoding: br, gzip, deflate by default, a malicious upstream server can reply with a weaponized Brotli stream.
3. Asset & Log Processing Pipelines: Background workers that extract user-uploaded archives or decompress telemetry streams.

Breakdown of All Vulnerabilities in the October 2026 Release

Alongside CVE-2026-111497, the October 2026 security advisory patches three additional vulnerabilities involving DNS resolution, TLS verification, and HTTP/2 frame handling:

Hidden Pitfalls in CVE-2026-105482 and CVE-2026-105483

In CVE-2026-105482, passing an unsanitized hostname string to dns.resolve*() allows an embedded NUL byte (\x00) to act as a string terminator inside the underlying C resolver (c-ares), while JavaScript-level validation inspects the full string. For example, internal.corp.local\x00.example.com passes a suffix check for .example.com, yet resolves internal.corp.local on the wire.

Meanwhile, CVE-2026-105483 exploits a Unicode normalization discrepancy when checking TLS certificate Subject Alternative Name (SAN) entries against targets formatted with fullwidth IPv4 digits.

Mitigation Guide and Upgrade Commands

Engineering teams should immediately upgrade Node.js across all CI/CD pipelines, Docker containers, and production hosts to the patched releases:

• Node.js 22 LTS: Upgrade to v22.23.4 or later
• Node.js 24 LTS: Upgrade to v24.22.1 or later
• Node.js 26 Current: Upgrade to v26.12.1 or later

Critical Notice for Node.js 20 Users: The Node.js 20 release line has reached End-of-Life (EOL) and does not receive patches for CVE-2026-111497. Organizations still running Node.js 20 must migrate to Node.js 22 LTS or 24 LTS immediately.

Updating Production Dockerfiles

Pin your container base images explicitly to the patched October 2026 versions:

# Pin official image with the October 2026 security patches
FROM node:22.23.4-bookworm-slim AS runtime

WORKDIR /app
ENV NODE_ENV=production

COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
COPY package.json ./

USER node
EXPOSE 3000
CMD ["node", "dist/server/entry.mjs"]

Emergency WAF / Reverse Proxy Mitigations

If you cannot redeploy your Node.js binaries within hours, apply these temporary workarounds at your Nginx, Envoy, or Cloudflare WAF layer:

1. Block Inbound Brotli-Compressed Requests: Reject or strip incoming HTTP requests containing Content-Encoding: br at the reverse proxy unless the endpoint is strictly authenticated.
2. Disable Brotli on Outbound Fetches to Untrusted URLs: When fetching user-provided URLs, explicitly override Accept-Encoding: gzip, deflate so remote servers do not return Brotli payloads.

// Temporary workaround when fetching untrusted external URLs
const response = await fetch(untrustedUserUrl, {
  headers: {
    // Omit 'br' until the Node.js runtime is upgraded to >= 22.23.4
    'Accept-Encoding': 'gzip, deflate'
  }
});

Both the Cyber Security Agency of Singapore (CSA Alert AL-2026-154) and major cloud providers such as Vercel have flagged this advisory for immediate remediation before the end of October 2026.