Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own
Source: Qualys Blog
At a glance
Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run end-of-life lines that will never receive a fix. In the meantime, interim mitigations from the Qualys Threat Research Unit narrow the Brotli, DNS, TLS, and keep-alive attack paths, and WAF, IPS, and EDR protections from major vendors add further layers. Soon, Qualys ETM will factor these controls into r…