Node.js security update: Brotli is not the only reason

What shipped on 21 October?

Node.js released security updates 22.23.4, 24.22.1 and 26.12.1. These are fixed releases within their respective branches, not instructions to downgrade newer software.

The advisory covers ten Node-specific vulnerabilities as well as dependency updates. One is Brotli flaw CVE-2026-111497: decompressing attacker-controlled input can corrupt process memory, potentially causing a crash, memory disclosure or code execution.

Does every website have the same exposure?

For the Brotli issue, the application must decompress attacker-supplied data through node:zlib. Calling every website vulnerable would be misleading. Other issues also depend on the functions used and the Node.js branch.

Fixes additionally address DNS resolution, TLS certificate checks, HTTP connection reuse and repeated random values after restoring startup snapshots, among other issues. Asking only whether the application uses a Brotli package misses the wider update.

What should your developer confirm?

1. Which Node.js version is actually serving our application?
2. Has the security update for that branch been installed, and has the application been restarted or redeployed with the fixed runtime?
3. Which of the advisory’s affected functions does our application use?

These release notes do not establish that your server was compromised. Any suspected intrusion needs a separate investigation.