Node.js fixes a Brotli decoder RCE

The Node.js release

Node.js published security releases for its 22.x, 24.x and 26.x lines on 21 October 2026: v22.23.4, v24.22.1 and v26.12.1. The release fixes ten CVEs, with the highest severity rated High.

One entry is unusually direct: CVE-2026-111497, a Brotli decoder out-of-bounds write that “permits remote code execution”. NVD’s later description says the underlying Brotli library range is 1.0.3 through 1.2.0 and that the flaw can corrupt adjacent decoder state, disclose memory, cause denial of service or potentially execute code. The Node.js advisory does not describe a specific attack path.

Why runtime and package inventories differ

This is a Node.js core issue. It is not PHP2Shell, it is not an npm package, and there is no evidence of a shared root cause. It is included because the date coincidence is instructive: two major server runtimes shipped critical memory-safety fixes on the same day.

The separation matters for inventory. A Node.js core flaw requires updating the runtime or rebuilding the container image. An npm package flaw requires resolving the dependency. A PHP flaw requires updating the PHP binary or its distribution package. A single “patch the app” ticket does not cover all three layers.

What to check

Confirm the runtime version of the process that actually serves traffic, not only the version in a lockfile or a build image tag. If the application bundles its own Brotli library, update that copy as well. NVD’s record was still marked “Awaiting Analysis” when checked; that is a status of the record, not a statement that the flaw is uncertain.