Node.js 22.23.4, 24.22.1 and 26.12.1 fix a high-severity Brotli decoder flaw that permits remote code execution (CVE-2026-111497), alongside other security issues.

Node.js’s official advisory identifies CVE-2026-111497 as a high-severity Brotli remote-code-execution flaw affecting release lines 22, 24 and 26.

Published 22 Oct 2026 · 01:34 UTC

Node.js Project ↗ · Source dated 21 Oct 2026

Browse all Live updates · Read Features