Node.js released security updates on October 21, 2026, for a vulnerability in its Brotli component that can allow code execution inside an application process. Tracked as CVE-2026-111497, the issue affects the 22.x, 24.x and 26.x release lines and is rated high severity by the project. The corrected versions are 22.23.4, 24.22.1 and 26.12.1.
The essential technical condition is decompression of Brotli data controlled by an attacker. According to the Node.js advisory, specially constructed input can corrupt process memory when handled by the vulnerable component. The documented consequences include application crashes, disclosure of process memory and code execution, depending on the specific exploitation path.
The update concerns the runtime used by applications, APIs and backend services. Checking this layer is part of web application security and needs to establish which version actually runs on the server. Installing a corrected release in a development environment and updating the production environment are separate operations.
Exposure depends on the data an application decompresses
Brotli is the compression format involved in this vulnerability. Its decoder, bundled with Node.js, misinterprets a particular invalid input and continues accepting data into insufficient internal storage. The advisory describes an out-of-bounds memory write, an operation that can affect the application process.
Node.js explicitly identifies the situation in which an attacker supplies Brotli data that an application decompresses through the node:zlib module. Vercel adds an important clarification in its own bulletin: processing can occur directly in application code or inside a library the application uses. The runtime component therefore needs to be considered alongside the actual data-processing path.
Vercel describes two routes. Compressed data can arrive in the body of an incoming application request or in a response from an external server fetched by the application. In the latter case, the operation originates inside the service's infrastructure, but the response content is controlled by the external system being contacted.
This distinction explains the different roles of inbound traffic protection and runtime patching. A filter applied to incoming requests examines data crossing the protected network. Responses downloaded by application functions from other services require correction of the component performing decompression.
Vercel deploys filtering rules and updates managed runtimes
Vercel announced that it deployed web application firewall rules on the same day the fixes were published, blocking known exploitation patterns on the inbound route. According to the company, the rules apply automatically to projects hosted on its platform, without additional configuration or a separate charge for this protection.
The company also began rolling out corrected Node.js releases across its managed runtimes. For projects configured to use the 22.x or 24.x lines, the platform manages patch versions. The bulletin consulted describes that rollout as ongoing and clearly distinguishes network protection from updating the execution environment itself.
Vercel projects still using Node.js 20 need to move to 22.x or 24.x and be redeployed. Node.js 20 has reached the end of its support period and will not receive this fix, according to Vercel's bulletin. Selecting a supported release line is therefore a specific remediation requirement, separate from installing a patch update.
For environments outside Vercel's managed infrastructure, the provider calls for an upgrade to one of the three corrected releases. Its list includes external backend servers, self-hosted Next.js installations, container images built by the application team, continuous integration infrastructure and local environments in which the project runs.
For containers, the stated procedure is to rebuild the image using a corrected Node.js version and redeploy it. For self-hosted Next.js, Vercel requires a Node.js upgrade and notes that Next.js image optimization does not block Brotli responses. Remediation therefore needs to cover the runtime actually distributed and deployed.
The security release addresses ten issues
The October 21 release covers ten vulnerabilities, rather than the Brotli issue alone. Four are classified as high severity. Alongside the decoder, the project corrected a DNS resolution problem and two errors in TLS certificate hostname verification, the mechanism used to authenticate the destination of an encrypted connection.
The DNS problem concerns the treatment of names containing a null character. Affected functions could interpret only part of the supplied name. For applications that validate a destination before resolving it, the difference between the checked name and the one actually used changes the control applied to that connection.
The high-severity TLS errors concern unusual representations of IP addresses and how different components interpret them. Under the conditions described by the project, certificate verification could accept an identity that did not match the actual destination. The affected release lines differ between these two issues.
Other fixes cover reuse of HTTP connections, certificate verification for non-canonical IPv4 addresses and the preservation of random values inside application startup snapshots. For the last issue, the advisory explains how identifiers can repeat across processes started from the same snapshot under the specified build conditions.
Node.js 26 also receives fixes for ZIP archive handling and certain filesystem permissions. Depending on the release line, the package updates dependencies including c-ares, OpenSSL, SQLite and Undici. The official record separates these components and their affected versions so that the change can be tracked for each environment an application uses.
