TL;DR

The Node.js project disclosed CVE-2026-111497, an out-of-bounds write in its Brotli decoder that may allow remote code execution. Node.js rates it High; Google’s CVE record assigns it 9.2 Critical under CVSS 4.0. Node.js 22.x, 24.x and 26.x are affected before versions 22.23.4, 24.22.1 and 26.12.1, respectively.

Action required: if your application runs Node.js, check its deployed version and ensure its version constraints do not keep it on an affected release. Update any unsafe pin or constraint, rebuild and redeploy the application, then verify the version in the new deployment. Scalingo’s Node.js buildpack includes the fixed releases, but an existing application does not receive a new runtime until it is rebuilt and redeployed.

What Happened?

On October 21, 2026, the Node.js project released security updates for its 22.x, 24.x and 26.x lines. Its advisory describes an out-of-bounds write in the bundled Brotli decoder. For software using Google Brotli independently of Node.js, the CVE record identifies fixed Brotli releases 1.0.10, 1.1.1 and 1.2.1 for their respective release lines.

The vulnerable code is reached when a Node.js process decompresses attacker-controlled Brotli data. Receiving an HTTP request is not enough by itself: the application or a dependency must decode its Brotli-compressed body. Outbound requests can also expose an application if it decompresses a Brotli response from an untrusted server. Serving Brotli-compressed responses to clients does not, by itself, invoke the vulnerable decoder.

On October 22, Imperva reported code execution through a fetched Brotli response and configured request-body parsers in tests using the official Node.js 24.22.0 Linux arm64 image. The same inputs were rejected by 24.22.1. These results do not establish that every application using an affected Node.js version is directly reachable.

What We Did

Scalingo added Node.js 22.23.4, 24.22.1 and 26.12.1 to its Node.js buildpack inventory. The inventory update does not change the runtime in an application that is already deployed. Confirm the version selected by your next build and running in the redeployed application.

What We Will Do

Starting 23 October 2026 at 15:00 CEST, Scalingo will reject incoming requests with the Content-Encoding: br header. If your clients send Brotli-compressed request bodies, change them to send uncompressed bodies without that header before this time. This measure covers incoming requests only; you still need to update Node.js to address Brotli responses fetched by your application.

If you need the filtering rule disabled, contact Scalingo support. Disabling it can restore the inbound exposure for applications that decode Brotli request bodies on an affected Node.js version.

What You Should Do

1. Check the Node.js version in your deployed application, for example with scalingo --app my-app run node --version in a one-off container.
2. Check the engines.node constraint in package.json and any custom buildpack or runtime pin. If it pins an affected release or excludes the fix, change it so the next build selects at least 22.23.4 on 22.x, 24.22.1 on 24.x, or 26.12.1 on 26.x. For example, an exact 24.22.0 pin must be updated. See Node.js version selection.
3. Rebuild and redeploy the application using your usual Git deployment or GitHub deployment process. Restarting the existing deployment does not replace its Node.js runtime.
4. Run node --version in a new one-off container after the deployment and confirm that the fixed version is running. If the version did not change, review the build log and version constraints before treating the application as updated.

Prioritize applications that decode Brotli request bodies or fetch and decompress responses from servers they do not control. This includes applications whose frameworks or HTTP clients perform decompression on their behalf. Updating the runtime addresses both paths.

If you use a custom container image or supply your own Node.js runtime, update that runtime in the image, rebuild and redeploy it, and check node --version in the running image. For an end-of-life Node.js line, move to a supported, fixed line; the Node.js security release provides fixes for 22.x, 24.x and 26.x.

Product Impacts

Scalingo PaaS

Applications running an affected Node.js version may be exposed if they decompress attacker-controlled Brotli data. The buildpack update does not change existing deployments; check the runtime version in each application after redeployment.

Contact

If you need help checking or updating an application, contact Scalingo support at support@scalingo.com or through the in-dashboard chat.

Timeline