MEDIUMVulnerability
Global

Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

·Source: Qualys Blog

Updated:

Executive Summary

Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not […]

Analysis

Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not […]

Indicators of Compromise (1)

CVE (1)
CVE-2026-111497
NVDMITRE CVE
Source Attribution

Originally published by Qualys Blog on Oct 23, 2026.

Related Threats

MEDIUMVulnerability

I recreated a Node2Shell (CVE-2026-111497) RCE attack in the form of an interactive exercise

[object Object]

CVE-2026-111497
r/blueteamsec
LOWVulnerability

Can’t Patch Node.js Yet? Build a Stopgap with the Controls You Own

Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run end-of-life lines that will never receive a fix. In the […]

CVE-2026-111497
Qualys Blog
LOWVulnerability

Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run end-of-life lines that will never receive a fix. In the […]

CVE-2026-111497
Qualys Blog