Node.js October 2026 Security Release: Brotli CVE-2026-111497 & SRE Patch Guide

1. The Core Vulnerability: CVE-2026-111497

The Brotli decoder vulnerability is triggered when the runtime decompresses attacker-controlled Brotli data. Malformed compressed input forces the decoder to write outside its intended memory buffer.

Exploitability Context: The Node.js project rates CVE-2026-111497 as a High-severity memory-corruption vulnerability that can lead to a crash, process-memory disclosure, or remote code execution. Public research may differ in its assessment of practical exploitability, but the absence of a demonstrated production exploit does not establish that a vulnerable deployment is safe. Prioritize the official runtime update.

2. Inbound vs. Outbound Decompression Vectors

The Inbound Vector (Express 4 vs. Express 5): Applications that accept attacker-controlled Brotli-encoded request bodies may be exposed if their middleware passes the payload to the vulnerable native decoder. Exposure depends heavily on your middleware configuration:

• Express 5: Utilizes body-parser ^2.3.0, where express.json() automatically inflates incoming request bodies tagged with Content-Encoding: br.
• Express 4: Relies on body-parser 1.x. The standard Express 4/body-parser 1.x path does not provide the same built-in Brotli request-body inflation support. This reduces exposure through that specific middleware path, but does not establish that the application is safe if custom middleware, direct node:zlib usage, or other Brotli-capable components process untrusted data.

The Outbound Vector (Undici & Fetch): Applications using the built-in fetch() should assess whether responses from untrusted or compromised upstream services can reach the vulnerable Brotli decompression path. Outbound exposure depends on the runtime version, response encoding, and request-handling path. Inbound WAF rules alone do not address every outbound decompression scenario.

3. Beyond Node.js: Python and Bun

The underlying flaw exists in Google's Brotli library, affecting other ecosystems that bundle it:

• Python: The PyPI release notes indicate the brotlicffi package is patched in version 1.2.1.0 (which incorporates the underlying libbrotli v1.2.1 fix), and the brotli package is patched in version 1.2.1. Verify that compatible wheels are available for your deployment platform.
• Bun: Bun releases up to 1.4.3 bundle an affected Brotli decoder. The project has addressed this security flaw in the Bun 1.4.4 release.

4. TLS, DNS, and Cryptographic Failures

The October 2026 release resolves 9 additional vulnerabilities. Ensure your infrastructure patching accounts for these critical networking and cryptographic fixes:

• eMudhra CA Trust Store Update: The security release updates the bundled CA trust data (NSS 3.131.1) and rejects certificate chains containing specifically blocked public keys associated with the eMudhra intermediate CA compromise. Deployments using custom trust stores should independently verify their certificate-validation configuration.
• TLS Hostname Verification Bypasses:
  • CVE-2026-105483 (High): Bypasses certificate checks when an IP address is written using fullwidth Unicode digits (Affects 24.x, 26.x).
  • CVE-2026-106069 (High): Bypasses certificate validation when hostnames resolve loosely to non-canonical IPv4 representations (Affects 22.x, 24.x, 26.x).
  • CVE-2026-106072 (Medium): A distinct TLS issue where DNS Subject Alternative Names (SANs) improperly authenticate non-canonical IPv4 endpoints (Affects 22.x, 24.x, 26.x).
• The SEA Crypto Entropy Bug (CVE-2026-106074 - Medium): When a snapshot or Single Executable Application (SEA) is built, calls to crypto.randomUUID(), crypto.randomUUIDv7(), crypto.randomInt(), or APIs that rely on these caches can preserve entropy-cache state in the snapshot. Processes started from that snapshot may repeat cached values until the cache is refilled (Affects 22.x, 24.x, 26.x).
• CVE-2026-105482 (High):dns.resolve*() and dns.reverse() truncate hostnames containing NUL characters. This allows an attacker to bypass domain allowlist validations (Affects 22.x, 24.x, 26.x).
• CVE-2026-105481 (Medium): HTTP keep-alive socket accepts a response preceding the request (Affects 22.x, 24.x, 26.x).
• CVE-2026-106073 (Low): Permission Model bypass through fs.realpathSync (Affects 22.x, 24.x, 26.x).
• CVE-2026-106070 (Low):zlib.ZipFile returns an attacker-controlled prefix after validation failure (Affects 26.x).
• CVE-2026-106071 (Low): Wildcard radix lookup over-grants filesystem permissions in the Permission Model (Affects 26.x).

5. SRE Playbook: Docker & Container Workloads

Updating your host OS via apt-get does not patch Node.js runtimes isolated inside Docker containers. You must explicitly pin the patched base image version in your Dockerfile (e.g., node:26.12.1-alpine).

To prevent the reuse of stale, vulnerable image layers, fetch the latest updates using --pull. If you suspect stale caching, utilize --no-cache:

docker build --pull --no-cache -t your-api:latest .

A successful build does not guarantee the patched version is active. Verify the runtime version inside the newly built image (docker run --rm your-api:latest node -v), push the new image digest to your registry, and trigger a rolling restart across your deployment to replace active pods.

6. SRE Playbook: Bare Metal, PM2, and Systemd Path Traps

Installing the new binary via Node Version Manager (NVM) does not automatically protect your application. Executing nvm alias default 24.22.1 changes the path for new terminal sessions, but running PM2 daemons and systemd units often hardcode the absolute path of the old executable.

To securely patch host-level processes:

1. Install the patched runtime: nvm install 24.22.1
2. Verify the new path in your shell using node -v and command -v node.
3. Check your PM2 ecosystem configuration files for any hardcoded interpreter paths.
4. Restart applications with the updated environment: pm2 restart all --update-env.
5. Update the PM2 daemon itself: pm2 update.
6. Regenerate systemd startup scripts: Run pm2 unstartup followed by pm2 startup with the correct privileges. Check the ExecStart and Environment directives in the resulting /etc/systemd/system/ unit files to ensure they point to the patched binary.

7. Running Node.js Executable Inventory (/proc)

Process names in top or htop can be deceptive. A process might be named next-server while silently running an outdated Node.js binary. To inventory the actual executables loaded into memory on a Linux host, inspect the kernel's process tree:

for d in /proc/[0-9]*; do
  exe=$(readlink "$d/exe" 2>/dev/null) || continue
  case "${exe% (deleted)}" in */node|*/nodejs) ;; *) continue ;; esac
  printf '%-8s %-70s\n' "${d#/proc/}" "$exe"
done

Inventory Limitations: If the output appends (deleted), the process is executing a replaced inode and requires a hard restart. However, an output lacking (deleted) (e.g., /usr/bin/node) does not definitively prove the process is patched. Use this inventory check in conjunction with deployment metadata, image digests, and planned restarts to verify runtime remediation.