Node.js said fixes for its 26.x, 24.x and 22.x lines were due on or shortly after October 21, 2026. Vercel reported they shipped that day. Ten flaws were fixed, and four rate high: a Brotli bug, two TLS hostname check bypasses and a dns.resolve bug. Brotli is a compression format. Node.js tracks the Brotli flaw as CVE-2026-111497 and says it allows remote code execution.
Node.js describes the Brotli flaw as the decoder writing outside the memory set aside for it. Vercel says a process that unpacks attacker-supplied Brotli data can leak memory or run the attacker's code. Node.js does not unpack Brotli by itself, Vercel says, so the risk needs app or library code that does. Responses an app fetches count as attacker input too, and only the runtime patch covers them. Neither source says whether attacks have occurred.
Vercel said its firewall rules block the inbound route for projects on its platform, but they cannot patch Node.js running elsewhere. It urges upgrades to 22.23.4, 24.22.1 or 26.12.1 for external backends, self-hosted Next.js, container images and CI runners. Node.js 20 gets no fix. The exposure sits in places few teams list. Leaders can ask where Node runs outside managed hosting, which projects use Node 20, and who patches images and CI.