What is the CVSS score and severity of CVE-2026-111498?

CVE-2026-111498 is rated MEDIUM with a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests).

CVE-2026-111498 MEDIUM · CVSS 6.5 · OpenJS Foundation — Node.js Runtime (llhttp) · 2026-10-27

CVE-2026-111498: Node.js llhttp Chunked Extension Request Smuggling

Q: What versions are affected by CVE-2026-111498?

CVE-2026-111498 affects Node.js 20.x, 22.x, 24.x, 25.x / 26.x in Node.js Runtime (llhttp) (Node.js llhttp Chunked Extension Request Smuggling).

Q: How do I patch or remediate CVE-2026-111498?

To remediate CVE-2026-111498, upgrade to the patched release: Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1. Upgrade Node.js to the patched October 2026 release. Configure upstream reverse proxies to normalize or reject HTTP/1.1 chunk extensions prior to forwarding requests to Node.js backends.

Inconsistent parsing of quoted-pair characters inside HTTP/1.1 Transfer-Encoding: chunked extensions in llhttp allows HTTP request smuggling when Node.js sits behind an upstream proxy that strips or forwards chunk extensions differently.

Identifier

CVE-2026-111498

Vendor / Product

OpenJS Foundation · Node.js Runtime (llhttp)

Severity / CVSS

MEDIUM · CVSS 6.5

Vector / CWE

CWE-444 (Inconsistent Interpretation of HTTP Requests)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected

Node.js 20.x, 22.x, 24.x, 25.x / 26.x

Patched Version

Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1

Priority

P2 — Upgrade Node.js & Normalize Reverse Proxy Framing

Executive Summary & Technical Impact

Tracked under CVE-2026-111498 (CWE-444 (Inconsistent Interpretation of HTTP Requests)), this vulnerability affects Node.js 20.x, 22.x, 24.x, 25.x / 26.x and carries a severity score of 6.5 (MEDIUM). Engineering and security operations teams running Node.js Runtime (llhttp) should prioritize upgrading to Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1.

Remediation & Patch Guidance

Upgrade Node.js to the patched October 2026 release.
Configure upstream reverse proxies to normalize or reject HTTP/1.1 chunk extensions prior to forwarding requests to Node.js backends.

Frequently Asked Questions (CVE-2026-111498)

What versions are affected by CVE-2026-111498?

CVE-2026-111498 affects Node.js 20.x, 22.x, 24.x, 25.x / 26.x in Node.js Runtime (llhttp) (Node.js llhttp Chunked Extension Request Smuggling).

How do I patch or remediate CVE-2026-111498?

Upgrade affected deployments to Node.js v20.20.4, v22.22.4, v24.16.0, v25.10.0 / v26.12.1 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-111498?

CVE-2026-111498 is rated MEDIUM with a CVSS score of 6.5 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Full TechPulse Investigation

Node.js October 2026 Security Emergency: Brotli RCE (CVE-2026-111497) & TLS Validation Bypass

A deep technical breakdown of the October 2026 Node.js security releases addressing a critical out-of-bounds write in the bundled Brotli decoder and NUL byte DNS truncation.

Read full engineering post-mortem (7 min read) →