> ## Documentation Index > Fetch the complete documentation index at: https://developer.upsun.com/llms.txt > Use this file to discover all available pages before exploring further. # Node.js Brotli RCE and October 2026 security releases: what to check > Node.js patched a Brotli decoder RCE (CVE-2026-111497) on October 21, 2026. See the patched versions, how Upsun updated its images, and what to check in your projects. > [!NOTE] > > **In short:** > > * If your app uses Upsun's `nodejs` runtime image on an active version (22, 24, or 26), Upsun has already updated these images to the patched Node.js versions. > To get the fix, [redeploy your environment](#redeploy-to-get-the-patched-image): it isn't applied automatically. > * The one remote code execution issue (the Brotli decoder, CVE-2026-111497) is already mitigated on Upsun by defense in depth (ASLR and a read-only filesystem), so the practical risk is low even before you redeploy. > * If your app runs an end-of-life Node.js version (20 or earlier), it won't receive a patch. See [What you need to do](#what-you-need-to-do). On October 21, 2026, the Node.js project released Node.js 26.12.1, 24.22.1, and 22.23.4. These versions fix several vulnerabilities across the 26.x, 24.x, and 22.x release lines. The most notable is a high-severity flaw in the Brotli decoder that can lead to remote code execution (RCE): [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high). For the full list, see the [Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upsun has updated its Node.js images to the patched versions. ## What was fixed The release fixes multiple vulnerabilities across the active release lines. The highest severity is **high**: there's no critical-rated issue in this release. The one that stands out is a Brotli decoder flaw that can permit remote code execution. | CVE | Description | Severity | Affected lines | | - | - | - | - | | CVE-2026-111497 | Brotli decoder out-of-bounds write that permits remote code execution. | High | 26.x, 24.x, 22.x | | CVE-2026-105482 | `dns.resolve` truncates names that contain a NUL character. | High | 26.x, 24.x, 22.x | | CVE-2026-105483 | TLS certificate hostname bypass when the IP is written with fullwidth digits. | High | 26.x, 24.x | | CVE-2026-106069 | TLS certificate hostname bypass when the host loosely resolves to an IP address. | High | 26.x, 24.x, 22.x | The release also fixes several medium- and low-severity issues and updates bundled dependencies such as c-ares, OpenSSL, SQLite, and Undici, as well as removing a compromised certificate authority. For the complete list and credits, see the [Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). ### How the Brotli RCE works Brotli is a compression format that Node.js can decompress, for example when it handles HTTP responses or requests that use Brotli content encoding. CVE-2026-111497 is a memory-safety bug in that decoder: when it processes crafted compressed input, it can write past the end of a buffer (an out-of-bounds write). In principle, an attacker who controls the compressed data an app decompresses could use this to run arbitrary code. Any app that decompresses untrusted Brotli data is potentially exposed, even if its own code is secure. Because the flaw is in Node.js itself, updating your framework or dependencies doesn't fix it: only a patched Node.js version does. On Upsun, defense in depth limits the practical risk. Address space layout randomization (ASLR) makes a reliable exploit hard to build, and the read-only application filesystem blocks the follow-on steps an attacker would need. At the time of writing, no public exploit has demonstrated code execution against these protections. They reduce exposure, but they don't replace the patched Node.js versions. ## Affected and patched versions The following table maps each active Node.js line on Upsun to its patched version: | Node.js line | Status on Upsun | Patched version | | - | - | - | | 26 | [Active](/docs/languages/nodejs#active-versions) | 26.12.1 | | 24 | [Active](/docs/languages/nodejs#active-versions) | 24.22.1 | | 22 | [Active](/docs/languages/nodejs#active-versions) | 22.23.4 | All three active lines are affected and have official patched releases. ### End-of-life Node.js versions Node.js 20 and earlier are end of life upstream and don't receive these fixes. On Upsun, these are [Sunset versions](/docs/languages/nodejs#sunset-versions): they keep working, but they won't get a patched image. See [Image statuses](/docs/core-concepts/upgrade-runtimes-services#image-statuses) for what each status means. **If you run Node.js 20 or earlier,** upgrade to an active version (22, 24, or 26). ## How Upsun responded As soon as the Node.js project published the patched versions, Upsun updated its Node.js images for the active lines (22, 24, and 26). The updated images are live. Because defense in depth already limits the one RCE issue (ASLR and a read-only filesystem), Upsun isn't forcing a redeploy of your environments. Instead, it's business as usual: your project picks up the patched image the next time its environment deploys. ## What you need to do If your app uses a `nodejs` runtime image on an active version, the patched image is already available. You just need to deploy it. ### Redeploy to get the patched image Trigger a [redeploy](/docs/troubleshooting/general#force-a-redeploy) of your environment to pick up the patched Node.js image. Any new push or deployment also picks it up automatically. ### Check your Node.js version After your environment redeploys, confirm the Node.js version your app runs: ```bash theme={null} upsun ssh --environment main --app myapp -- node -v ``` Replace `main` with your environment name and `myapp` with your app name. If your project has a single app, you can omit `--app`. The output should show a patched version from the [table above](#affected-and-patched-versions). If it still shows an older version, Upsun might not have redeployed your environment yet. ### If you run an end-of-life version If your app runs Node.js 20 or earlier, no patched image is available. [Upgrade to an active version](/docs/languages/nodejs#active-versions) by changing the `type` of your app in your configuration file, for example: ```yaml theme={null} applications: myapp: type: 'nodejs:24' ``` To pin or manage a specific Node.js version, see [Manage Node.js versions](/docs/languages/nodejs/node-version). ### Outside Upsun Upgrade Node.js to the patched versions anywhere else you run it, including: * Local development machines * Docker images * CI pipelines ## Acknowledgments Thanks to the Node.js project and its security team for coordinating the disclosure and shipping these fixes. The Brotli decoder issue (CVE-2026-111497) was reported by `mcollina` and fixed by `aduh95`. For the full list of reporters and fixers, see the [Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). ## Questions If you have questions about your project, [contact Upsun support](/docs/core-concepts/get-support). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.