Node.js patches Brotli decoder flaw enabling remote code execution

Node.js released security updates on October 21 for its three supported release lines, fixing ten flaws including a critical out-of-bounds write in the Brotli decoder. The fixed versions are 22.23.4 and 24.22.1 on long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix. The vulnerability, identified as CVE-2026-111497, affects Brotli decoder versions 1.0.3 through 1.2.0 on all platforms.

The flaw allows crafted compressed data to overwrite past the end of a buffer, potentially causing crashes, memory leaks, or execution of attacker-controlled code. It is triggered by malformed compressed input and affects applications decoding untrusted Brotli data via fetch() or middleware like Express 5. The same Brotli fix shipped in versions 1.2.1, 1.1.1, and 1.0.10 on October 21, meaning other software bundling Brotli may need updates. The change in the Brotli source code was first made in February 2026 and shipped as a security release only in October.

Security researchers at Imperva demonstrated that malicious Brotli data can make an application on an official Node.js build run attacker-supplied code. Their 'Node2Shell' proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64. Imperva reproduced code execution through both the request-body and response paths, testing Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0. On the fixed release 24.22.1, the same data was rejected and no code ran. No exploitation of the flaw in the wild has been reported as of October 22.