Node.js has patched a Brotli decoder flaw, CVE-2026-111497, that can lead to remote code execution. The Node.js security release page, dated October 21, rates it high and lists fixed releases for the 22, 24 and 26 lines.
What the flaw is
Node.js says a malformed compressed input makes the bundled Brotli decoder write past the end of an internal eight-byte buffer. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory. Node lists a crash, disclosure of process memory or remote code execution as the outcomes.
The same Node release fixes other CVEs, which we do not cover here. Node credits OpenAI Codex Security (Khai Tran and Sylvie Mayer) with the report and mcollina with the fix.
Check your version and upgrade
Run node -v on every server, build machine and container. Then compare it with this table, from Node's page.
| Your line | Upgrade to |
|---|---|
| Node.js 22.x | 22.23.4 or later |
| Node.js 24.x | 24.22.1 or later |
| Node.js 26.x | 26.12.1 or later |
Our reading of Node's page is that end-of-life lines are not covered by these releases. If you run one, plan a move to a supported line.
Other software with the same Brotli bug
The flaw is not only in Node. Wiz's write-up says upstream Google Brotli 1.0.3 through 1.2.0 is affected, excluding the patched backports below, and it also lists fixed versions for Python, Bun, Envoy, Istio and Go. The Google Brotli project lists releases 1.0.10, 1.1.1 and 1.2.1 as the fixes, all published October 21.
- Python: Brotli 1.2.1 and brotlicffi 1.2.1.0.
- Bun: 1.4.4 (versions 1.0.21 through 1.4.3 are affected).
- Envoy: 1.36.12, 1.37.8, 1.38.6, 1.39.3 or 1.40.0.
- Istio: 1.29.9, 1.30.6 or 1.31.2.
- Go: andybalholm/brotli v1.2.7.
The researchers call the bug critical and nickname it Broccoli2Shell, also called HTTP2Shell. Node rates it high. The nickname does not mean HTTP/2 is required.
If you cannot patch yet
Exploitation needs your app, or a library it uses, to decompress attacker-controlled Brotli data. That includes incoming requests and responses fetched from other servers, and some HTTP clients and frameworks decompress automatically when Brotli is enabled.
Microsoft's Azure guidance says Azure WAF can block Brotli-compressed request bodies as a stopgap. It also says a WAF cannot protect apps that fetch and decompress Brotli responses from external servers, and a block rule may hit legitimate clients, so log first.
What this means for you / what we checked
If you run Node.js 22, 24 or 26, upgrade and confirm with node -v. For many teams that covers it, though you should also check the other software listed above.
Our own advice, not Node's: if you deploy with Docker, rebuild your images from an updated base, because a running container keeps its old Node. Also check Bun, Python and proxy versions in the list above.
We found no confirmed reports of attacks in the sources we read, and no CVSS score, so we make no claim either way. We read the Node.js, Wiz and Azure pages in full and checked the Google release notes. The same researchers say 91% of the cloud environments they see have vulnerable resources; that is their own data.
For other recent patch-now stories, see GitLab's critical self-managed flaw and our guide on rotating secrets after a breach.
