Node.js Fixes Brotli RCE Bug That CISA Now Lists as Exploited. Update to 22.23.4, 24.22.1 or 26.12.1

TL;DR: The Node.js project released Node.js 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026, fixing 10 vulnerabilities across its three supported release lines. The most serious, CVE-2026-111497, is an out-of-bounds write in Node’s Brotli decoder that Node.js says “permits remote code execution.” Four flaws are rated High, including three TLS and DNS issues, and the releases also pull in fixes for OpenSSL, c-ares, Undici and SQLite and distrust the compromised eMudhra certificates. If you run anything on Node.js, from an API server to a self-hosted n8n or a build pipeline, update the runtime and redeploy. The Brotli flaw also affects Bun, Envoy, Istio, Python packages, .NET, PHP’s Windows builds, Ubuntu and some Palo Alto firewalls (see the Oct 27 updates). New Oct 28: CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, citing evidence of active exploitation, and security firms ELLIO and Previdian report exploit attempts against the Brotli flaw, so patch now. New Oct 29: AWS says its Lambda runtimes for Node.js and .NET are affected and is rolling out patched runtimes through October 31. Lambda functions need a real update or a rebuild to pick them up (see the Oct 29 update).

Update, Oct 29, 2026, 9:00 p.m. Manila: AWS lists which of its services need action. AWS published security bulletin 2026-155-AWS on October 28 at 3:00 p.m. Pacific time (6:00 a.m. Oct 29 Manila). It says the Lambda service itself isn’t affected, but its Lambda runtimes for Node.js and .NET are. Python, Ruby and the OS-only provided.al2023 runtimes don’t include Brotli, though AWS says to redeploy with a patched version if you bundle the library yourself. For Node.js 22, 24 and 26, the container base images are already updated, so rebuild and redeploy container-image functions now. ZIP functions get the patched runtime in two phases. In Phase 1 (target October 28), Lambda applies it when you update a function’s code or configuration, and AWS warns that “a zero-change update is not sufficient.” Its suggested trick is to add or bump an environment variable. In Phase 2 (target October 30), functions on the Auto runtime update mode are updated automatically. AWS says it can’t forecast exact timing per Region. For .NET 8, 9 (container images only) and 10, the targets are October 28 for container base images, October 29 for Phase 1 and October 31 for Phase 2. To confirm a function is patched, look at the INIT_START line in its logs for nodejs:22.mainline.v157 or nodejs:24.mainline.v114 or higher. AWS notes that process.version doesn’t reflect the fix on Node.js 24. For that line, AWS says it is patching the current runtime rather than moving to 24.22.1, citing a known regression in that release. Node.js 18 and 20 runtimes get no update. On other AWS services: App Runner’s updated Node.js runtime has been in all Regions since October 26, so redeploy services once if you haven’t since then (update the pin first if you pinned a runtime version). Elastic Beanstalk’s Node.js platform 6.11.12, released October 22, has the fixed Node.js versions and arrives in your next weekly window if managed updates are on. CodeBuild’s curated images are due by October 30 and drop Node.js 18 and 20. Amplify Hosting server-side rendering on Node.js 22 and 24, Node.js CloudWatch Synthetics canaries on automatic updates, and MediaLive need no action from you. If you run Node.js yourself on EC2, ECS or EKS, updating is your job. For teams that can’t patch yet, AWS gives an example AWS WAF rule that blocks requests sent with Content-Encoding: br. Run it in Count mode first, because it also blocks legitimate Brotli uploads. The fixed Node.js versions haven’t changed: 22.23.4, 24.22.1 and 26.12.1.

Update, Oct 28, 2026, 8:35 p.m. Manila: exploit attempts seen in the wild, and code execution shown on standard x86-64 Node.js. Security firm ELLIO says its sensors recorded an exploit attempt for CVE-2026-111497, which researchers call “Node2Shell”, on October 26 at 15:08 UTC (11:08 p.m. Manila). It was a single 23 MB Brotli-compressed request aimed at the official Node.js 24.22.0 build on x86-64. ELLIO says the request reused publicly available exploit code but added its own final stage, which got no shell in 50 of ELLIO’s lab tries, and says this “was likely a first-generation attempt.” Separately, ELLIO says its researchers got remote code execution on the official, unmodified Node.js 24.22.0 x86-64 build, against a plain node:http server, the node:24.22.0-slim image, Express 5.3.0 and Koa 3. Imperva’s Red Team had earlier shown code execution on arm64. Threat-intelligence firm Previdian lists the flaw as “Confirmed”, with exploitation attempts observed by its sensors. Previdian’s page for the flaw says its sensors recorded one attempt, from one US-based IP address, first seen October 27. Neither firm reports a successful compromise, and Previdian says a sensor observation means an attempt “whether or not the target was actually vulnerable or the attempt succeeded.” ELLIO also found in its lab that most failed attempts crashed the process, so an unpatched server can be knocked offline even when the attempt doesn’t get a shell. The fixed versions haven’t changed: 22.23.4, 24.22.1 and 26.12.1.

Update, Oct 28, 2026, 7:01 a.m. Manila: CISA says the Brotli flaw is now exploited. The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, “based on evidence of active exploitation,” and gave federal civilian agencies until November 10, 2026 to fix it. CISA lists the entry under Google Brotli, not Node.js, and doesn’t say who was targeted, through which product, or whether ransomware groups are involved (its catalog marks ransomware use as “Unknown”). CISA’s assessment on the CVE record now lists exploitation as “active,” up from “none” on October 23. The Center for Internet Security’s advisory 2026-120, issued October 27, says there are “no reports of malicious exploitation in the wild” but that “public proof-of-concept code is available.” The fixed Node.js versions haven’t changed: 22.23.4, 24.22.1 and 26.12.1. If you haven’t updated Node.js and the other Brotli software listed below, do it now.

Update, Oct 27, 2026, 12:47 p.m. Manila: the Brotli flaw reaches well beyond Node.js. CVE-2026-111497 sits in Google’s open-source Brotli library, versions 1.0.3 through 1.2.0. Google, which assigned the CVE, rates it 9.2 (Critical) under CVSS 4.0, higher than Node’s High, and its fixed releases are 1.0.10, 1.1.1 and 1.2.1. OpenAI, whose Codex Security researchers found the bug, lists fixes on its disclosure page for Bun (1.4.4), Envoy (1.40.0, 1.39.3, 1.38.6 or 1.37.8) and Istio (1.29.9, 1.30.6 or 1.31.2), and Python’s Brotli 1.2.1 and brotlicffi 1.2.1.0 are fixed too. OpenAI says on X that an unpatched client that accepts compressed input, such as curl --compressed, “could be taken over by a malicious server.” On October 26 more vendors followed. PHP published rebuilt Windows packages, 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, that include Brotli 1.2.1; it says the flaw is reachable there through the cURL extension when automatic response decompression is turned on, which is off by default in cURL but can be enabled by applications and HTTP client libraries. Ubuntu fixed its brotli packages for 22.04 LTS through 26.10 in USN-8956-1. Palo Alto Networks rates the flaw Critical, with a suggested urgency of Moderate: PAN-OS 11.2, 12.1 and 12.2 firewalls that inspect Brotli traffic with decryption on are exposed, and its hotfixes are due between October 27 and 30. Fortinet’s FG-IR-26-187 groups the flaw with the other Node.js CVEs and says it’s still investigating FortiOS. At that point no attacks had been reported and the flaw wasn’t in CISA’s Known Exploited Vulnerabilities catalog; that changed later on October 27 (see the Oct 28 update above). Details and stopgaps are in What to do now.

Update, Oct 27, 2026, 4:14 p.m. Manila: .NET is affected too. Microsoft released out-of-band security updates on October 25, 2026 (18:45 UTC): .NET 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 Release Candidate 3, a preview build (RC2 users should move to RC3). Microsoft describes CVE-2026-111497 in .NET as a buffer overflow that “may allow an unauthenticated attacker to read or corrupt process memory,” which could lead to information disclosure, denial of service or elevation of privilege. Apps are exposed only if they process Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs; Microsoft notes that request decompression and automatic response decompression are off by default, and .NET Framework isn’t affected. The same release fixes CVE-2026-114148, a Linux tarball ownership flaw, and re-releases fixes for CVE-2026-70197 and CVE-2026-102870 because the October 13 update didn’t fully address them.

What changed

According to the Node.js security release post and the release notes:

• Fixed versions: Node.js 22.23.4, 24.22.1 (LTS) and 26.12.1. All three release lines, 22.x, 24.x and 26.x, were affected. Node.js notes that “End-of-Life versions are always affected when a security release occurs.”
• CVE-2026-111497 (High), Brotli decoder out-of-bounds write that “permits remote code execution”: affects 26.x, 24.x and 22.x. Node.js credits OpenAI Codex Security researchers with reporting it. The 24.22.1 release notes show the fix is a patch to Node’s bundled Brotli library.
• CVE-2026-106069 (High): a TLS certificate hostname bypass “when the host loosely resolves to an IP address” (26.x, 24.x, 22.x).
• CVE-2026-105483 (High): a TLS certificate hostname bypass when the IP address is written with fullwidth digits (26.x and 24.x).
• CVE-2026-105482 (High): dns.resolve truncates names containing a NUL character (26.x, 24.x, 22.x).
• Medium: a keep-alive socket can process a response written before the request was sent (CVE-2026-105481); certificate validation for non-canonical IPv4 hostnames lets DNS names in a certificate authenticate IP endpoints (CVE-2026-106072); and crypto.randomUUID() and randomInt() caches are saved into user-land startup snapshots and single executable apps, “so every process repeats the same values” (CVE-2026-106074).
• Low: two Permission Model bypasses (CVE-2026-106071, CVE-2026-106073) and a ZipFile prefix-bytes issue (CVE-2026-106070, 26.x only).
• Dependency fixes: c-ares, the CA certificate store (for the eMudhra intermediate CA compromise), Undici on all three lines, OpenSSL on 24.x and 22.x, and SQLite on 22.x.

The highest severity Node.js assigns to any issue in this release is High; none are rated Critical. Google, which assigned CVE-2026-111497, rates the Brotli flaw 9.2 (Critical) under CVSS 4.0.

Why it matters

Node.js runs a large share of the web tools small teams depend on: Next.js and Astro sites, Express and Fastify APIs, Discord and Slack bots, self-hosted automation tools like n8n, and most JavaScript build pipelines. Brotli is a common compression format on the web, so a bug in the decoder is the kind of flaw that can be reached by data coming from outside. The TLS fixes matter if your app makes HTTPS calls to IP addresses or relies on Node to check certificates on outbound requests.

Updating npm packages doesn’t fix any of this. These bugs are in the Node.js runtime itself, so you have to update Node and restart or redeploy.

What to do now

1. Check which Node.js you run. Run node -v on each server, and check the Node version or base image your hosting platform, Dockerfiles and CI use.
2. Update to the fixed release for your line: 22.23.4, 24.22.1 or 26.12.1. If you use a version manager, install the new version and switch to it; on servers, install your distribution’s or NodeSource’s updated package once it’s out.
3. Rebuild containers. If your Dockerfile uses a node:22, node:24 or node:26 tag, rebuild so the image pulls the new release, and pin the exact version if you can.
4. Check your host. On serverless and managed platforms, the provider chooses the Node.js patch version. Check its changelog or status page, and redeploy if it says you need to. On AWS, follow bulletin 2026-155-AWS (see the Oct 29 update). For Lambda, rebuild container-image functions now. For ZIP functions, make a real code or configuration change once the patched runtime reaches your Region, then check the INIT_START log line. Redeploy App Runner services not deployed since October 26, and move Elastic Beanstalk environments to Node.js platform 6.11.12.
5. Move off old versions. Node.js 20 and older aren’t on the list of patched lines. If you’re still on one, plan a move to 22 or 24, since End-of-Life versions get no fixes.
6. Restart everything that runs Node. Long-running processes keep using the old runtime until they restart.
7. Check whether you’re exposed and whether anyone tried. Our advice: you’re exposed if your app decompresses Brotli data that someone else controls, for example Express 5 or Koa body parsers handling requests sent with Content-Encoding: br, or fetch() calls to URLs an outsider can influence. Check node -v, not process.versions.brotli, which ELLIO says reads 1.2.0 on both patched and unpatched builds. In your logs, look for unusually large request bodies sent with Content-Encoding: br followed by bursts of Node.js crashes or restarts; in ELLIO’s lab, most failed attempts crashed the process.
8. Update everything else that decodes Brotli. Bun users need 1.4.4; Bun says to rebuild any bun build --compile executables and to “treat this as a remote code execution risk.” Envoy deployments with the Brotli decompressor configured need 1.40.0, 1.39.3, 1.38.6 or 1.37.8; Envoy’s 1.36.12 also has the fix, but Envoy’s release schedule shows 1.36 reached end of life on October 14, 2026. Istio users who enable Brotli decompression need 1.29.9, 1.30.6 or 1.31.2; Istio says 1.29.9 is the last 1.29 release. In Python, update Brotli to 1.2.1 or brotlicffi to 1.2.1.0. OpenAI’s page also says to check Electron-based desktop apps, curl or libcurl builds and other bundled copies of the library.
9. Check your operating system and other vendors. On Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS or 26.10, Ubuntu says a standard system update installs the fixed brotli packages. If you run PHP on Windows, PHP’s -1 builds carry the fix. On Palo Alto firewalls, run show system setting brotli; Palo Alto says you’re exposed only if Brotli inspection and decryption are on, and you should install the hotfix for your PAN-OS version when it ships. Fortinet hasn’t finished checking FortiOS, so watch FG-IR-26-187. For .NET, install 8.0.33, 9.0.22 or 10.0.14 (or RC3 if you’re testing the .NET 11 preview) and restart framework-dependent apps; Microsoft says self-contained apps must be rebuilt and republished, because a newer runtime on the host doesn’t update the one bundled with the app, and containers must be rebuilt on updated .NET images. dotnet --list-runtimes shows what a machine has installed.
10. If you can’t patch yet, stop decoding untrusted Brotli. OpenAI’s disclosure page suggests rejecting requests with Content-Encoding: br before any body parser runs, disabling automatic Brotli decompression in HTTP clients, and turning off Brotli decompressor filters in Envoy and Istio. For Next.js on an unpatched Node.js, it suggests images.unoptimized: true, which stops the built-in image optimizer from fetching and decoding remote images. On PAN-OS 11.2.4 and later, Palo Alto’s workaround is set system setting brotli-encoding disable. These are stopgaps, not fixes.

These are the same Node.js versions our eMudhra certificate story lists as patched for the compromised certificates, so one update covers both.

Updates

• Oct 29, 2026, 9:00 p.m. Manila: Added AWS security bulletin 2026-155-AWS, published October 28. Lambda’s Node.js and .NET runtimes are affected, with patched runtimes rolling out through October 31. Added how to pick up and verify the fix on Lambda, what App Runner, Elastic Beanstalk, CodeBuild and other AWS services need, and AWS’s example WAF rule. Fixed Node.js versions are unchanged.
• Oct 28, 2026, 8:35 p.m. Manila: Added that security firm ELLIO recorded an exploit attempt aimed at Node.js 24.22.0 on x86-64 on October 26 and showed code execution on standard x86-64 Node.js builds in its lab, and that Previdian lists exploitation attempts as observed by its sensors. Neither reports a successful compromise. Added a step on checking exposure and logs. Fixed versions are unchanged.
• Oct 28, 2026, 7:01 a.m. Manila: CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, citing evidence of active exploitation, with a November 10 federal deadline. Updated the headline, summary, exploitation status and method to match, and added the Center for Internet Security’s advisory 2026-120, which still says there are no reports of exploitation in the wild but that public proof-of-concept code exists. Fixed versions are unchanged.
• Oct 27, 2026, 4:14 p.m. Manila: Added Microsoft’s October 25 out-of-band .NET updates (8.0.33, 9.0.22, 10.0.14 and the .NET 11 RC3 preview), which fix CVE-2026-111497 in .NET, with who is exposed and how to update.
• Oct 27, 2026, 12:47 p.m. Manila: Added that CVE-2026-111497 is in Google’s Brotli library (fixed in 1.0.10, 1.1.1 and 1.2.1; rated 9.2 Critical by Google under CVSS 4.0), OpenAI’s disclosure page, and fixed versions for Bun, Envoy, Istio and Python’s Brotli packages. Also added PHP’s rebuilt Windows packages, Ubuntu’s USN-8956-1, Palo Alto’s PAN-OS advisory and hotfix schedule, and Fortinet’s FG-IR-26-187, plus stopgaps for systems that can’t patch yet.
• Oct 22, 2026, 10:20 p.m. Manila: First published. We’ll add a dated note here if Node.js revises its advisory or publishes more detail on the Brotli flaw.

Sources & method

Sources

• Node.js, “Wednesday, October 21, 2026 Security Releases”
• Node.js 24.22.1 (LTS) release notes, Oct 21, 2026
• Node.js 22.23.4 release notes
• Node.js 26.12.1 release notes
• Node.js vulnerability RSS feed (publication time)
• CVE-2026-111497 record (CNA: Google)
• Google Brotli v1.2.1 release, v1.1.1 and v1.0.10
• OpenAI, Patch the Planet: “Brotli decoder vulnerability (CVE-2026-111497),” updated Oct 23, 2026
• OpenAI on X, Oct 23, 2026, 22:55 UTC
• Bun security advisory GHSA-663w-cv8g-jj2p
• Envoy security advisory GHSA-3wvj-j6qm-62mr
• Envoy RELEASES.md (release schedule; 1.36 reached end of life on Oct 14, 2026)
• Istio, ISTIO-SECURITY-2026-007
• PyPA advisory PYSEC-2026-4322 (Brotli) and PYSEC-2026-4323 (brotlicffi)
• Microsoft .NET Blog, “.NET October 2026 Out-of-Band Security Updates,” Oct 25, 2026
• PHP, “Updated PHP Windows builds for Brotli security fix,” Oct 26, 2026
• Ubuntu, USN-8956-1: Brotli vulnerability, Oct 26, 2026
• Palo Alto Networks, “Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products,” Oct 26, 2026
• Fortinet, FG-IR-26-187, “Multiple Node.js CVEs,” Oct 26, 2026
• CISA Known Exploited Vulnerabilities catalog (version 2026.10.27)
• CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” Oct 27, 2026
• Center for Internet Security, advisory 2026-120, “A Vulnerability in Brotli Library Could Allow for Remote Code Execution,” Oct 27, 2026
• ELLIO, “Node2Shell: remote code execution on stock Node.js builds (CVE-2026-111497),” Oct 25, 2026, updated Oct 26
• Previdian, Known Exploited Vulnerabilities feed and methodology · Previdian, CVE-2026-111497
• AWS security bulletin 2026-155-AWS, “CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure,” Oct 28, 2026
• The Hacker News, “Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges,” Oct 28, 2026

Method. First checked October 22, 2026, at 10:20 p.m. Manila time (14:20 UTC); rechecked October 27, 2026, at 12:32 p.m. Manila time (04:32 UTC) and again at 4:13 p.m. Manila time (08:13 UTC); rechecked October 28, 2026, at 7:01 a.m. Manila time (23:01 UTC) and at 4:08 p.m. Manila time (08:08 UTC); rechecked October 29, 2026, at 7:05 p.m. Manila time (11:05 UTC). The Node.js fixed versions, CVE IDs, severities, affected release lines and dependency updates come from the Node.js security release post; the Brotli patch detail comes from the 24.22.1 release notes. The Brotli library versions, Google’s score and CISA’s exploitation assessments (“none” on October 23, “active” on October 27) come from the CVE record; the Bun, Envoy, Istio, Python, .NET, PHP, Ubuntu, Palo Alto and Fortinet details come from each one’s advisory or announcement; that Envoy 1.36 is out of support comes from Envoy’s RELEASES.md, which lists its end of life as October 14, 2026; the stopgaps come from OpenAI’s disclosure page and Palo Alto’s advisory; KEV status, the date added and the November 10 federal deadline come from CISA’s catalog (version 2026.10.27) and its October 27 alert; the Center for Internet Security’s exploitation wording comes from its advisory 2026-120; the in-the-wild attempt, its timing and target, and the x86-64 code execution come from ELLIO’s post; Previdian’s status comes from its feed and its meaning from its methodology page; the single Previdian attempt, its US origin and its date come from Previdian’s page for CVE-2026-111497; the AWS service status, Lambda rollout dates, verification steps and WAF rule come from AWS bulletin 2026-155-AWS. Steps 1 to 7 under “What to do now” are our own judgment; steps 8 to 10 summarize the vendors’ and OpenAI’s guidance. No affiliate links on this page. How we work.