Node.js ships security releases fixing a remote code execution flaw

In a web service, Node.js usually shows up in two places: on a server answering API requests, or in the build tools that produce the site's files before deployment. Take a fictional information site. The developer uses Node.js to render pages into HTML ahead of time, and the hosting server just sends the finished files. No Node.js runs when a visitor opens a page, but the build environment that made those files still has it.

Imagine a fictional weather service. Our Node.js server requests readings from an outside weather server, decompresses the response, then displays the temperature. Brotli is a format used to send web data in a smaller form, and Node.js includes code to unpack it again. Its official documentation shows receiving an external HTTP response and decompressing it with Brotli. Official compressed-response example

Usually, the response contains weather readings. If an attacker can influence its contents and crafted data reaches the vulnerable Brotli decoder in an unpatched Node.js, that processing becomes an entry point. The attacker is supplying data the app meant to read, rather than a program the operator knowingly asked it to execute.

Which services have such a route depends on their implementation. Look for features that unpack uploaded Brotli data, read compressed responses from outside servers, or fetch and unpack external data during builds. Not every upload or HTTP request automatically invokes this vulnerable operation.

Memory is the temporary space where a running program puts its working information. Decompression code must write its results inside the area reserved for them. This flaw writes outside that area—an out-of-bounds write—and Node.js identifies CVE-2026-111497 as allowing remote code execution, or RCE. Official security notice

Picture a workbench with a space for incoming data and other notes needed to do the work. Writing inside the data space leaves those notes alone; writing past its boundary can overwrite information the program relies on. Real memory contains data and information used to continue execution, and corruption of the latter can, under particular conditions, let an attacker redirect execution. MITRE’s out-of-bounds write explanation

The risk can therefore go beyond displaying the wrong temperature. A task meant to read data may be made to do something else chosen by an attacker. Not every large input or shortage of memory produces RCE, and this article does not reproduce an attack input or its success conditions.

If RCE succeeds, the malicious code generally operates with the compromised program’s permissions. Files and secrets Node.js can read, files it can write, and databases it can access shape the damage. RCE does not automatically grant the machine’s administrator privileges or access to other company servers.

The following are possible damage scenarios, not reported incidents or test results establishing that this flaw caused them at a particular service.

Say fictional server A runs v24.22.0. It's on the 24.x line, but the fix for that line is 24.22.1, so server A isn't patched yet.

Linux distributions and managed hosts sometimes copy fixes into their own packages, which is called a backport. In that case the version number alone won't tell you much, so read the supplier's package revision and security fix history as well.

npm manages the packages an app pulls in. This fix lives in Node.js itself and the components bundled inside it, so running npm update on your app won't apply it. You need to replace the Node.js executable, or the container image that carries it.

• List the servers, containers and build environments running Node.js.
• Obtain a fixed package for each and test app compatibility.
• Replace executables or images, then restart or redeploy as required.
• Check the running version and real application functions again.

For that last check, run through the features this release touches, such as login, API responses, outbound HTTPS calls and handling compressed responses.