Node.js Releases Critical Security Updates to Fix Brotli Remote Code Execution and Network Flaws
Node.js released security updates for 10 vulnerabilities, including a critical remote code execution flaw in the Brotli decoder (CVE-2026-111497) and multiple network validation bypasses. These vulnerabilities reside in the core runtime, requiring administrators to update host systems, rebuild container images, and restart all services.
**If you run Node.js anywhere, update it right away to version 22.23.4, 24.22.1 or 26.12.1, then rebuild any containers or apps that bundle Node.js and restart all Node.js services (your usual dependency scanners won't catch this, so check the runtime versions yourself). If you're still on old versions like 20.x, 23.x or 25.x, they will never be fixed. Move to a supported version ASAP. Until you can patch, block Brotli-compressed (br) traffic at your proxy or firewall as a temporary shield.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/node-js-releases-critical-security-updates-to-fix-brotli-remote-code-execution-and-network-flaws-e-l-q-t-c/gD2P6Ple2L
BeyondMachinesNode.js Releases Critical Security Updates to Fix Brotli Remote Code Execution and Network FlawsNode.js released security updates for 10 vulnerabilities, including a critical remote code execution flaw in the Brotli decoder (CVE-2026-111497) and multiple network validation bypasses. These vulnerabilities reside in the core runtime, requiring administrators to update host systems, rebuild container images, and restart all services.