Executive Summary:

A high-severity vulnerability (CVE-2026-111497) was disclosed affecting Node.js across all supported release lines (22.x, 24.x, 26.x), allowing attackers to achieve remote code execution via malformed Brotli-compressed data processed by node:zlib or fetch(). Due to the potential for crashes, memory disclosure, and code execution in cloud workloads, immediate patching is required.

About CVE-2026-111497

The issue originates from the bundled Brotli decompression library, where an invalid block switch declaring only one block type is not properly rejected, leading to an out-of-bounds write past the decoder buffer boundary. By sending specially crafted Brotli-compressed HTTP responses or request bodies, attackers can trigger memory corruption and crash target applications, potentially achieving remote code execution. No authentication is required to exploit this issue when the target processes attacker-controlled compressed data.

Affected Systems

The following components are affected: the Brotli decoder bundled in Node.js, exposed through node:zlib decompression APIs and the built-in fetch() function when handling Brotli-compressed HTTP responses (Content-Encoding: br). Node.js versions prior to 22.23.4, 24.22.1, and 26.12.1 are vulnerable, as are upstream Brotli library versions prior to 1.2.1, 1.1.1, and 1.0.10. Node.js 20.x and earlier have reached end-of-life and will not receive patches. Any application decompressing attacker-controlled Brotli data is at risk, including cloud workloads, serverless functions, and container images running unpatched Node.js.

The same security release also addresses three additional high-severity issues. CVE-2026-106069 and CVE-2026-105483 allow TLS hostname verification bypass via non-canonical IP address formats (octal, fullwidth digits) that circumvent tls.checkServerIdentity() checks. CVE-2026-105482 is a DNS resolver flaw where embedded NUL bytes truncate domain names, enabling resolution of attacker-chosen domains. In total, the release fixes 10 vulnerabilities: four High, three Medium, and three Low severity.

Remediation

Users should upgrade immediately to Node.js 22.23.4, 24.22.1, or 26.12.1, and rebuild container images on patched base images. There is no reliable in-app workaround for the Brotli flaw; setting Accept-Encoding: identity does not prevent fetch() from decompressing Brotli responses. Node.js 20.x users must migrate to a supported release line. For the TLS issues, an interim mitigation is to reject hosts where net.isIP(host) returns 0 but net.isIP(url.domainToASCII(host)) returns non-zero. For the DNS issue, reject names containing NUL characters before passing them to dns.resolve functions.

Risk Impact

At the time of writing, a public proof-of-concept published on October 22 achieved code execution only on a deliberately weakened test build; on standard production builds it caused a crash and limited memory read. No in-the-wild exploitation has been reported. Regardless, the severity and ease of exploitation make this vulnerability high risk, especially in internet-facing deployments where applications process Brotli-compressed data from untrusted sources.

Successful exploitation could allow attackers to crash Node.js processes and cause denial of service, read sensitive memory contents from the application, and potentially achieve full remote code execution, leading to service disruption, data exposure, or infrastructure compromise across cloud environments.How Orca Can Help

Orca enables customers to quickly identify assets running vulnerable Node.js versions, understand their exposure in context, including internet accessibility, runtime reachability, and asset criticality, and prioritize remediation based on real risk rather than CVSS alone. Orca’s platform highlights affected assets directly in the alert view, helping security teams focus on the most critical remediation paths first.