---
type: "post"
id: "node-js-security-advisory-a-high-severity-rce-4b2e5e"
slug: "node-js-security-advisory-a-high-severity-rce-4b2e5e"
title: "Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26."
description: "The Node.js Project published security releases for the 26.x, 24.x, and 22.x release lines on October 21, 2026."
retrieval_nugget: "The Node.js Project published security releases for the 26.x, 24.x, and 22.x release lines on October 21, 2026."
published_at: "2026-10-22"
updated_at: "2026-10-22"
record_date: "2026-10-22"
date_kind: "published_at"
topics: ["agent-security","sandbox"]
entities: ["Node.js Project","Node.js","Brotli","OpenSSL","Undici"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Node.js disclosed a separate high-severity Brotli decoder RCE affecting Node.js 22, 24, and 26; none of the prior documents covers this advisory."
prior_refs: []
source_url: "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
source_urls: ["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:node-js-security-advisory-a-high-severity-rce-4b2e5e"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/node-js-security-advisory-a-high-severity-rce-4b2e5e/","markdown":"https://newruntime.com/posts/node-js-security-advisory-a-high-severity-rce-4b2e5e.md","json":"https://newruntime.com/posts/node-js-security-advisory-a-high-severity-rce-4b2e5e.json"}
---

# Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.

## Retrieval answer

The Node.js Project published security releases for the 26.x, 24.x, and 22.x release lines on October 21, 2026.

The Node.js Project published security releases for the 26.x, 24.x, and 22.x release lines on October 21, 2026. The releases are Node.js v26.12.1, v24.22.1, and v22.23.4. The project rates the highest-severity issue in each affected line as HIGH.

CVE-2026-111497 is a high-severity out-of-bounds write in the Node.js Brotli decoder. The advisory says the flaw permits remote code execution and affects Node.js 26.x, 24.x, and 22.x. Other high-severity fixes cover NUL-containing names in dns.resolve and two TLS certificate hostname-validation issues. The release also includes medium- and low-severity fixes and dependency updates including c-ares, ca-cert, OpenSSL, SQLite, and Undici.

The source does not describe a public exploit, confirmed exploitation, attack prerequisites, or which application configurations expose the Brotli decoder to untrusted input. It advises using an up-to-date supported version.

Source: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)