On October 21, 2026, Node.js released security updates for 22.x, 24.x and 26.x. The most severe issue, CVE-2026-111497, is a high-severity flaw in Node's Brotli decoder. A Node.js process that decodes Brotli data from an attacker can be made to leak memory or run arbitrary code. The release fixes nine other issues, including two high-severity TLS hostname verification bypasses.
Vercel deployed WAF rules the same day that block the inbound attack vector for every project on Vercel. We are also rolling the patched Node.js versions across Vercel's managed runtimes and will update this page as that completes.
Copy link to headingRequired action
If you run Node.js anywhere outside Vercel's managed runtimes, upgrade to 22.23.4, 24.22.1 or 26.12.1 now, regardless of WAF protections. That includes external backends, self-hosted Next.js, container images you build yourself, CI runners and local development.
Projects on Vercel that still use Node.js 20.x must change their Node.js version to 22.x or 24.x and redeploy. Node.js 20 reached end of life and will not receive this fix. Projects on Node.js 22.x or 24.x do not need to change their version setting; Vercel manages patch versions for those runtimes.
Copy link to headingWho is affected
Node.js does not decode Brotli data on its own. Your application is exposed when its code, or a library it uses, decompresses Brotli data an attacker controls, whether in a request body or in a response it fetches. Only the runtime patch covers fetched responses.
Copy link to headingUnderstanding CVE-2026-111497
The flaw is in the Brotli decoder bundled with Node.js. Malformed Brotli input causes an out-of-bounds write during decoding. Researchers demonstrated process-memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x. Execution runs with the permissions of the Node.js process. Read the Node.js advisory for the full list of fixed issues.
Copy link to headingVercel WAF protection
Vercel WAF has rules in place to detect and block exploitation attempts against this vulnerability. They apply to every project on Vercel automatically, at no cost, with no configuration needed. Blocked requests appear in your project's Firewall dashboard.
The WAF covers traffic that passes through Vercel's network. It does not cover responses your functions fetch from other servers. It reduces exposure but does not replace patching.
Copy link to headingHow to upgrade and protect your application
Copy link to headingProjects on Node.js 20.x on Vercel
Set the Node.js version to 22.x or 24.x in project settings or engines.node, then redeploy.
Copy link to headingContainer images and environments you run yourself
Rebuild on a patched Node.js base image and redeploy. For self-hosted Next.js, upgrade Node.js; Next.js does not block Brotli responses in image optimization.
Copy link to headingExternal Node.js backends behind Vercel
Upgrade Node.js on those servers. Restrict direct access so traffic reaches them only through Vercel.
Copy link to headingNext steps
- Read the Node.js October 2026 security release.
- Review blocked requests in your project's Firewall dashboard. See the Vercel Firewall documentation.
- Contact security@vercel.com with questions.