Node.js patches Brotli RCE (CVE-2026-111497) in 22.x, 24.x, 26.x

Node.js shipped 22.23.4, 24.22.1 and 26.12.1, fixing ten CVEs including CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that permits remote code execution. The flaw triggers on decompression of a malformed Brotli stream, including via built-in fetch(), which decodes Brotli by default with no off switch.

• CVE-2026-111497 is an out-of-bounds write in the Brotli decoder enabling RCE
• Built-in fetch() decodes Brotli responses with no caller option to disable
• Fixes only land on 22.x, 24.x and 26.x; 18.x and 20.x get no patch
• Distros built with --shared-brotli need a fix from the brotli package