CVE-2026-111497
Known exploited · CISA KEV
Microsoft patch: Release Notes.
Patch available KB5133964 Download →
CISA federal remediation date Nov 10
Vulnerabilities · 3h ago
Qualys reports that just 42,000 of 3.3 million Node.js installations it observed are patched for CVE-2026-111497, a flaw in the Brotli decoder. Another 1.7 million run end-of-life Node.js lines, including 20.x, 21.x, 23.x and 25.x, that will not get a fix. Supported releases include 22.23.4, 24.22.1 and 26.12.1.
Brotli decompresses data sent to an application. A remotely supplied compressed payload can overflow the decoder’s buffer and corrupt memory before the application handles the content, potentially enabling remote code execution. Qualys says temporary network and runtime controls can reduce risk, but cannot replace an upgrade.
If Node.js is bundled into containers, application folders, single-executable apps or serverless functions, it may remain exposed even when ordinary dependency checks find no vulnerable package. End-of-life deployments have no same-line patch, so their exposure persists until the runtime moves to a supported release.
Known exploited · CISA KEV
Microsoft patch: Release Notes.
Patch available KB5133964 Download →
CISA federal remediation date Nov 10
1 source covering this story
Can’t Patch Node.js Yet? Build a Stopgap with the Controls You Own | Qualys
Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow.
Part of the PlainSec briefing for 2026-10-28