Node.js Brotli RCE and October 2026 security releases: what to check

In short:

If your app uses Upsun’s nodejs runtime image on an active version (22, 24, or 26), Upsun has already updated these images to the patched Node.js versions. To get the fix, redeploy your environment: it isn’t applied automatically.
The one remote code execution issue (the Brotli decoder, CVE-2026-111497) is already mitigated on Upsun by defense in depth (ASLR and a read-only filesystem), so the practical risk is low even before you redeploy.
If your app runs an end-of-life Node.js version (20 or earlier), it won’t receive a patch. See What you need to do.

On October 21, 2026, the Node.js project released Node.js 26.12.1, 24.22.1, and 22.23.4. These versions fix several vulnerabilities across the 26.x, 24.x, and 22.x release lines. The most notable is a high-severity flaw in the Brotli decoder that can lead to remote code execution (RCE): CVE-2026-111497. For the full list, see the Node.js security release. Upsun has updated its Node.js images to the patched versions.

What was fixed

The release fixes multiple vulnerabilities across the active release lines. The highest severity is high: there’s no critical-rated issue in this release. The one that stands out is a Brotli decoder flaw that can permit remote code execution.

CVE	Description	Severity	Affected lines
CVE-2026-111497	Brotli decoder out-of-bounds write that permits remote code execution.	High	26.x, 24.x, 22.x
CVE-2026-105482	`dns.resolve` truncates names that contain a NUL character.	High	26.x, 24.x, 22.x
CVE-2026-105483	TLS certificate hostname bypass when the IP is written with fullwidth digits.	High	26.x, 24.x
CVE-2026-106069	TLS certificate hostname bypass when the host loosely resolves to an IP address.	High	26.x, 24.x, 22.x

The release also fixes several medium- and low-severity issues and updates bundled dependencies such as c-ares, OpenSSL, SQLite, and Undici, as well as removing a compromised certificate authority. For the complete list and credits, see the Node.js security release.

How the Brotli RCE works

Brotli is a compression format that Node.js can decompress, for example when it handles HTTP responses or requests that use Brotli content encoding. CVE-2026-111497 is a memory-safety bug in that decoder: when it processes crafted compressed input, it can write past the end of a buffer (an out-of-bounds write). In principle, an attacker who controls the compressed data an app decompresses could use this to run arbitrary code. Any app that decompresses untrusted Brotli data is potentially exposed, even if its own code is secure. Because the flaw is in Node.js itself, updating your framework or dependencies doesn’t fix it: only a patched Node.js version does. On Upsun, defense in depth limits the practical risk. Address space layout randomization (ASLR) makes a reliable exploit hard to build, and the read-only application filesystem blocks the follow-on steps an attacker would need. At the time of writing, no public exploit has demonstrated code execution against these protections. They reduce exposure, but they don’t replace the patched Node.js versions.

Affected and patched versions

The following table maps each active Node.js line on Upsun to its patched version:

Node.js line	Status on Upsun	Patched version
26	Active	26.12.1
24	Active	24.22.1
22	Active	22.23.4

All three active lines are affected and have official patched releases.

End-of-life Node.js versions

Node.js 20 and earlier are end of life upstream and don’t receive these fixes. On Upsun, these are Sunset versions: they keep working, but they won’t get a patched image. See Image statuses for what each status means. If you run Node.js 20 or earlier, upgrade to an active version (22, 24, or 26).

How Upsun responded

As soon as the Node.js project published the patched versions, Upsun updated its Node.js images for the active lines (22, 24, and 26). The updated images are live. Because defense in depth already limits the one RCE issue (ASLR and a read-only filesystem), Upsun isn’t forcing a redeploy of your environments. Instead, it’s business as usual: your project picks up the patched image the next time its environment deploys.

What you need to do

If your app uses a nodejs runtime image on an active version, the patched image is already available. You just need to deploy it.

Redeploy to get the patched image

Trigger a redeploy of your environment to pick up the patched Node.js image. Any new push or deployment also picks it up automatically.

Check your Node.js version

After your environment redeploys, confirm the Node.js version your app runs:

  upsun ssh --environment main --app myapp -- node -v

Replace main with your environment name and myapp with your app name. If your project has a single app, you can omit --app. The output should show a patched version from the table above. If it still shows an older version, Upsun might not have redeployed your environment yet.

If you run an end-of-life version

If your app runs Node.js 20 or earlier, no patched image is available. Upgrade to an active version by changing the type of your app in your configuration file, for example:

  applications:
    myapp:
      type: 'nodejs:24'

To pin or manage a specific Node.js version, see Manage Node.js versions.

Outside Upsun

Upgrade Node.js to the patched versions anywhere else you run it, including:

Local development machines
Docker images
CI pipelines

Acknowledgments

Thanks to the Node.js project and its security team for coordinating the disclosure and shipping these fixes. The Brotli decoder issue (CVE-2026-111497) was reported by mcollina and fixed by aduh95. For the full list of reporters and fixers, see the Node.js security release.

Questions

If you have questions about your project, contact Upsun support.

​What was fixed

​How the Brotli RCE works

​Affected and patched versions

​End-of-life Node.js versions

​How Upsun responded

​What you need to do

​Redeploy to get the patched image

​Check your Node.js version

​If you run an end-of-life version

​Outside Upsun

​Acknowledgments

​Questions