Node.js fixed a Brotli decoder bug that can run code, and Vercel says Node 20 projects must move to 22 or 24

The Node.js October 21, 2026 security release lists CVE-2026-111497, "Node.js Brotli decoder out-of-bounds write permits remote code execution," as high severity and says it affects Node.js 26.x, 24.x, and 22.x. The fixed releases are 22.23.4, 24.22.1, and 26.12.1. The CVE record, published October 22, 2026 by Google, places the bug in Google's Brotli library, versions 1.0.3 to before 1.0.10, 1.1.0 to before 1.1.1, and 1.2.0 to before 1.2.1, fixed in Brotli 1.0.10, 1.1.1, and 1.2.1. It scores it CVSS 4.0 9.2 Critical, while the Node.js post rates it high. On October 27, 2026, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The KEV entry names it "Google Brotli Unchecked Return Value Vulnerability" and lists a November 10, 2026 due date. The alert says the directive applies to Federal Civilian Executive Branch agencies. CISA identifies Google Brotli as the vulnerable component but does not identify which product using it was attacked. CISA's SSVC assessment on the CVE record now lists exploitation as "active".

Vercel's security bulletin says Node.js does not decode Brotli data on its own. An app is exposed when its code, or a library it uses, decompresses Brotli data an attacker controls, whether in a request body or in a response it fetches. Vercel says researchers demonstrated process-memory disclosure and command execution on unpatched 22.x, 24.x, and 26.x, running with the permissions of the Node.js process. It also says the release fixes nine other issues, including two high-severity TLS hostname verification bypasses.

Vercel deployed WAF rules the same day for every project and says it is rolling the patched versions across its managed runtimes. Its bulletin, now dated October 29, says that as of October 28 at 11 AM PT, all new deployments on Vercel use a patched version of Node.js. The bulletin says the WAF does not cover responses your functions fetch from other servers and does not replace patching. The bulletin also describes a temporary runtime protection added while the patched versions roll out: new deployments on unpatched managed Node.js versions stop asking for Brotli on outbound requests made with fetch(), node:http or node:https, and reject Brotli-encoded responses before decompressing them. Vercel says to redeploy existing projects to get this protection. Projects on Node.js 22.x or 24.x do not need to change their version setting. Projects still on Node.js 20.x must change to 22.x or 24.x and redeploy, because Node.js 20 is end of life and will not receive this fix. Anything outside Vercel's managed runtimes, including external backends, self-hosted Next.js, container images you build yourself, CI runners, and local development, needs the upgrade. For self-hosted Next.js, the bulletin notes that Next.js does not block Brotli responses in image optimization.

Bun bundles the same library. Bun's advisory, GHSA-663w-cv8g-jj2p, published October 23, 2026, says Bun 1.0.21 through 1.4.3 are affected and that Bun 1.4.4 updates Brotli to 1.2.1. It says Bun's fetch asks for and decodes Brotli responses by default, so a server the app connects to can send data to the decoder, and that executables built with bun build --compile stay affected until they are rebuilt with 1.4.4. Bun says it has not tested an attack against Bun and asks users to treat it as a remote code execution risk.