# Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)

**Author:** Security Team

---

On October 21, 2026, [Node.js released security updates](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) for 22.x, 24.x and 26.x. The most severe issue, [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), is a high-severity flaw in Node's Brotli decoder. A Node.js process that decodes Brotli data from an attacker can be made to leak memory or run arbitrary code. The release fixes nine other issues, including two high-severity TLS hostname verification bypasses.

Vercel deployed WAF rules the same day that block the inbound attack vector for every project on Vercel. We are also rolling the patched Node.js versions across Vercel's managed runtimes and will update this page as that completes.

### Required action

**If you run Node.js anywhere outside Vercel's managed runtimes, upgrade to** [**22.23.4**](https://nodejs.org/en/blog/release/v22.23.4)**,** [**24.22.1**](https://nodejs.org/en/blog/release/v24.22.1) **or** [**26.12.1**](https://nodejs.org/en/blog/release/v26.12.1) **now, regardless of WAF protections.** That includes external backends, self-hosted Next.js, container images you build yourself, CI runners and local development.

Projects on Vercel that still use Node.js 20.x must [change their Node.js version](https://vercel.com/docs/functions/runtimes/node-js/node-js-versions) to 22.x or 24.x and redeploy. Node.js 20 reached end of life and will not receive this fix. Projects on Node.js 22.x or 24.x do not need to change their version setting; Vercel manages patch versions for those runtimes.

## Who is affected

Node.js does not decode Brotli data on its own. Your application is exposed when its code, or a library it uses, decompresses Brotli data an attacker controls, whether in a request body or in a response it fetches. Only the runtime patch covers fetched responses.

## Understanding CVE-2026-111497

The flaw is in the Brotli decoder bundled with Node.js. Malformed Brotli input causes an out-of-bounds write during decoding. Researchers demonstrated process-memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x. Execution runs with the permissions of the Node.js process. Read the [Node.js advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) for the full list of fixed issues.

## Vercel WAF protection

[Vercel WAF](https://vercel.com/docs/vercel-firewall) has rules in place to detect and block exploitation attempts against this vulnerability. They apply to every project on Vercel automatically, at no cost, with no configuration needed. Blocked requests appear in your project's Firewall dashboard.

The WAF covers traffic that passes through Vercel's network. It does not cover responses your functions fetch from other servers. It reduces exposure but does not replace patching.

## How to upgrade and protect your application

### Projects on Node.js 20.x on Vercel

Set the Node.js version to 22.x or 24.x in project settings or `engines.node`, then redeploy.

### Container images and environments you run yourself

Rebuild on a patched Node.js base image and redeploy. For self-hosted Next.js, upgrade Node.js; Next.js does not block Brotli responses in image optimization.

### External Node.js backends behind Vercel

Upgrade Node.js on those servers. [Restrict direct access](https://vercel.com/docs/routing/rewrites#restricting-your-origin-to-vercel-traffic) so traffic reaches them only through Vercel.

## Next steps

- Read the [Node.js October 2026 security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).
  
- Review blocked requests in your project's Firewall dashboard. See the [Vercel Firewall documentation](https://vercel.com/docs/vercel-firewall).
  
- Contact [security@vercel.com](mailto:security@vercel.com) with questions.

---

[View full KB sitemap](/kb/sitemap.md)