Payments are experiencing issues due to temporary restrictions in Russia. If your payment does not go through, please submit a support request.Our support team is available 24/7 — we are always here to help with hosting and server issues.We are now accepting requests for dedicated server rental and colocation services in our data center.Reminder: we recommend enabling backups for additional data protection.A new VPS/VDS lineup with NVMe storage and improved performance is now available.Maintenance work on some servers has been completed. All services are operating normally.
Article7 min readViews3

Node.js Vulnerability CVE-2026-111497: What to Update and Check Immediately

A Brotli decompression error can cause application crashes, disclosure of data from memory, or code execution. We list the fixed Node.js versions and the procedure for checking servers, containers, and integrations. Separate section: important update for Windows PHP builds.

АльбинаCommunity author★ 151
Comments 0

Illustration: an administrator at a desk carefully reviewing information on a monitor
In this article

If your website, API, bot, or integration runs on Node.js, have your administrator check for security updates today. The CVE-2026-111497 vulnerability in Brotli decompression can lead to application crashes, process memory disclosure, or remote code execution. Fixes have been available since October 21, 2026; if they are not yet installed, do not delay the update.

  • Check all Node.js instances, including those inside containers and background services.
  • Install the fixed release of a compatible supported branch: 22.23.4, 24.22.1, or 26.12.1 — or a later version with the fix.
  • Restart affected applications and confirm that all worker processes use the updated runtime.

What Happened and How Dangerous It Is

The official Node.js security advisory dated October 21 describes a flaw in its bundled Brotli decoder. A specially crafted stream can write beyond the bounds of an internal buffer. An application is exposed when it or one of its libraries passes attacker-controlled data to the vulnerable decoder.

Node.js developers have assigned the issue a High severity. In the GitHub Advisory Database, the Brotli vulnerability is rated CVSS 4.0 — 9.2 with a Critical level. These are assessments from different sources; both justify prioritizing an update.

The vulnerability notification itself does not prove that a specific server was compromised. Updating patches the vulnerable component, while checking for possible compromise is a separate task.

Which Node.js Versions Need Updating

Node.js branch

First patched release

What to install

22.x

22.23.4

A patched release of your supported branch or a later release with this patch

24.x

24.22.1

A patched release of your supported branch or a later release with this patch

26.x

26.12.1

A patched release of your supported branch or a later release with this patch

The fix has been confirmed in the official releases Node.js 22.23.4, 24.22.1, and 26.12.1. There is no need to upgrade directly from 22.x to 26.x solely for this fix; instead, select a compatible updated release from your supported branch.

For branches that have reached end of life, plan a transition to a supported patched version. If Node.js is bundled within a ready-made product or a distribution package, verify the patch against the vendor's bulletin: the vendor may release its own builds and backport patches without changing the main version.

Who this affects

Check Node.js server applications: APIs, integration handlers, bots, server-side rendering, background workers, and build environments. For a 1C-Bitrix store, this is a reason to clarify the infrastructure composition: separate Node.js services may run alongside the PHP site.

The dangerous path can be either incoming or outgoing: an application may unpack the request body or the response from an external server. This is explained separately in the Vercel bulletin from October 26. Therefore, filtering incoming requests alone does not cover all scenarios for handling untrusted data.

What to assign to the administrator right now

  • Compile a list of affected services. Include production instances, standby instances, containers, background tasks, and build tools. For each, record the Node.js version, startup method, and responsible person.
  • Check configuration and data backups. Save startup parameters and prepare a recovery procedure. If possible, test the update in a staging environment; with multiple instances, update them sequentially while monitoring readiness.
  • Install the corrected Node.js environment from a trusted source. Updating only the application's npm dependencies does not replace fixing the runtime's built-in decoder.
  • Restart all affected processes and background handlers according to the established deployment procedure. A single-service update may require a brief maintenance window.
  • Verify the result: check the version in new worker processes, auto-startup, APIs, account login, forms, and external system integration. Ensure old instances no longer accept traffic.

How to verify the version without false confidence

The initial check can be performed in the terminal using the command:

node --version

This displays the Node.js version from the current terminal environment. The systemd service, PM2 application, or container may use a different executable. Check each separately, under the appropriate user and accounting for startup configuration.

For diagnostics directly within the application, process.version and process.execPath are available: the runtime version and the executable file path. Their purpose is described in the Node.js documentation. Use secure administrative diagnostics; there is no need to publish such information on a public website page.

Special attention: Docker and PM2

Containers. Updating Node.js on the host does not change the copy inside the image. Update the base image or pinned digest you are using, rebuild the application, and deploy new containers while preserving persistent data. Docker recommends rebuilding images with updated dependencies. Re-running an old image leaves the old environment in place.

PM2. Check the application interpreter and auto-start configuration: after an update, they may still point to the previous Node.js path. The PM2 documentation explicitly states that after updating Node.js, you must update the startup script. Choose the restart order for each specific application, taking its operating mode into account.

If an immediate update is not possible

Temporary mitigations must specifically address decompression of untrusted Brotli data. Until the fix is installed, administrators should:

  • Limit or temporarily disable the relevant incoming data handlers, if permissible for the service.
  • Review external HTTP downloads and automatic response decompression by libraries; restrict requests to untrusted sources.
  • Increase monitoring of decompression errors, process crashes, and unusual process activity.

The mechanism described by developers implies that disabling Brotli-compressed responses in Nginx or a CDN does not guarantee protection for the Node.js decoder. Similarly, a WAF placed in front of a site does not necessarily control responses that the application downloads from external sources. These measures do not replace fixing the runtime environment.

What to do if exploitation is suspected

Check for unexpected Node.js crashes, changes to files and startup entries, unfamiliar processes, and unusual network connections. Such events require investigation, but on their own do not prove exploitation of this CVE.

If signs of compromise are detected, isolate the affected service, preserve logs and evidence for investigation, and engage a security specialist. After containing the incident, rotate the affected secrets from a trusted environment. Applying the patch does not remove the consequences of an already successful breach.

Important note for PHP users

The error lies within Brotli and is not limited to Node.js. On October 26, the PHP team announced updated Windows builds of PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 with the fixed Brotli 1.2.1. In vulnerable Windows builds of PHP, the Brotli decoder can be invoked via cURL when automatic HTTP response decompression is enabled; cURL does not enable this by default, but applications may enable it.

The -1 suffix indicates a rebuild of the Windows package with updated dependencies: the PHP runtime version itself remains unchanged. This is a separate check for Windows. For Linux and other products, refer to notifications from the respective package providers; updating Node.js does not automatically fix them.

What the project owner should obtain from the administrator

Ask the administrator to provide a list of verified services, versions after the update, confirmation that all instances have been restarted, and the results of core site functionality checks. If part of the infrastructure has not yet been updated, temporary measures, the responsible person, and the completion deadline must be specified.

If your project is hosted with General iT, submit the request via your personal account: specify the service and application requiring Node.js and Brotli checks. Do not include passwords, tokens, or private keys in the request.

Information verified on October 27, 2026. Basis: official notifications from Node.js, PHP, and Vercel, release records, and developer documentation.

GENERAL IT

Help with your project

GENERAL IT

Read more on this topic

Discussion 0

Share your experience and ask questions. Comments without links appear after editorial review.

No comments yet. Start the discussion.