A Serious Node.js Flaw: What to Update and How.

• Brotli Decompression Flaw

  9.2out of 10Critical

  1. Low
  2. Medium
  3. High
  4. Critical

  CVE

  CVE-2026-111497

  Where it is

  The Brotli decoder bundled with Node.js and used by node:zlib.

  What it is

  A malformed Brotli stream makes the decoder keep writing past the end of a small internal buffer instead of stopping with an error.

  What an attacker could do

  Crash the process, read memory, or run their own code, without logging in. Node.js rates it High. The CVE record scores it 9.2, Critical, under CVSS v4.0.

  Known attacks

  ELLIO reports exploit traffic aimed at Node.js 24.22.0 reaching its sensors at 11:08 AM Eastern on October 26 (15:08 UTC). Imperva showed code execution on the official Node.js 24.22.0 image on October 22, through fetch() and Express 5, and confirmed 24.22.1 rejects the same input. It was not in the CISA Known Exploited Vulnerabilities catalog when we last checked.

  CVSS v4.0 vector

  CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

  Official advisory

  Node.js security release and GHSA-9v8h-qqgm-4m35

Your code does not need to mention Brotli. According to Akamai's analysis, the bad data can arrive three ways:

• Code that decompresses Brotli data itself: Any call to zlib.brotliDecompress or zlib.createBrotliDecompress on data that came from outside your own systems.
• The built-in fetch(): fetch() decompresses Brotli responses automatically, so a malicious or compromised server you call can send the bad data back to you.
• Express 5 and body-parser 2: Their json, raw, text, and urlencoded parsers decompress request bodies sent with Content-Encoding: br by default. Anyone who can reach the endpoint can send one, with no login.

A bare Node.js HTTP server does not decompress request bodies on its own, and Express 4 with body-parser 1 only decodes gzip and deflate. Even so, update: other code in your app, or a library it uses, may call fetch() or zlib. The same flaw sits in Google's Brotli library, so other software that bundles it needs its own update, including PHP for Windows.

Linux distributions can patch Node.js without changing its version number. If your Node.js comes from Debian, Ubuntu, or Red Hat packages, check the distribution's tracker, such as Ubuntu's page for this CVE.

The releases also update bundled dependencies, including c-ares, undici, OpenSSL, SQLite, and the list of trusted certificate authorities.

• On the Command Line

  node -v

  Shows the version on that machine. Run it on the server, not your own computer, and check every server that runs your app.

• Inside the Running App

  process.version

  Logging this from the app itself shows the version actually serving traffic, which can differ from the one on the command line.

• In Docker

  docker compose exec app node -v

  Replace app with the name of your service. The FROM line in your Dockerfile tells you which Node.js image it starts from.

• For Express Apps

  npm ls express body-parser

  Shows which versions your app installs. Express 5 and body-parser 2 decode Brotli request bodies; Express 4 with body-parser 1 does not.

1. List every place Node.js runs: web servers, background workers, scheduled jobs, build machines, and Docker images.
2. Try the update on a staging copy first if you have one. A security release stays on the same major version, so it is a small change.
3. Install the fixed release for your line with the method below, then rebuild and redeploy any images.
4. Restart every Node.js process so it loads the new runtime. A process that keeps running still uses the old version.
5. Check the version again from inside the running app, and keep a note of what you changed.

• In Express 5 or body-parser 2, set inflate: false on each body parser. Compressed request bodies are then refused with an HTTP 415 error instead of being decoded.
• Refuse request bodies sent with Content-Encoding: br at your proxy or load balancer if your app does not need them.
• Update body-parser to 2.4.0 or 1.20.9 as well. They fix a separate denial of service flaw in compressed request bodies, CVE-2026-111181.
• Limit which outside servers your app fetches from until the update is in.
• Put the update on the calendar with a named person and a date.

1. Oct 21, 2026. The Node.js project publishes the security releases for the 26, 24, and 22 lines.
2. October 22, 2026. Imperva shows code execution on the official Node.js 24.22.0 Linux arm64 image. body-parser 2.4.0 and 1.20.9 are released.
3. October 26, 2026, 11:08 AM Eastern (15:08 UTC). ELLIO reports exploit traffic aimed at Node.js 24.22.0 reaching its sensors.
4. Oct 27, 2026. We last checked the sources on this page.

• Node.js October 2026 security releases (nodejs.org)
• CVE-2026-111497 in the National Vulnerability Database
• CVE-2026-111497 record (CVE.org)
• GitHub advisory GHSA-9v8h-qqgm-4m35 (Brotli)
• The upstream Brotli fix (google/brotli)
• body-parser advisory GHSA-27r3-jxmh-p828
• Node.js release schedule (nodejs/Release)
• Ubuntu tracker for CVE-2026-111497
• Imperva: Node2Shell, From Brotli Data to Remote Code Execution
• Akamai: Inside Node2Shell, A Closer Look at CVE-2026-111497
• ELLIO: Node2Shell exploit traffic on stock Node.js builds