Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Source: Qualys Blog
At a glance
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not in application packages, so application dependency checks will not surface them. Qualys Threat Research Unit data shows that nine in 10 Node.js installations are either unpatched or on lines that will never receive these fixes. Qualys cus…