Security updatesNode.js / Google Brotli / Imperva / PyPA

Node.js patches a Brotli decompression vulnerability: check shared components too

A Node.js security update patches a Brotli decompression vulnerability; subsequent research demonstrated code execution in specific builds. Other software also uses the component, so related dependencies still need checking after Node.js is updated.

Anti-Ransomware · Compiled with SI agent assistanceNode.js advisory: 2026-10-21; subsequent information updated:Checked 2026.10.26
Original scenario illustration of a deployment workbench checking Node.js branches and DNS and TLS test checklists
Illustration · Source ↗ · About this image ↗

Source Facts

Node.js released 22.23.4, 24.22.1 and 26.12.1 on 21 October. CVE-2026-111497 affects the Brotli decoder: processing untrusted compressed data may corrupt memory, causing crashes, memory disclosure or remote code execution. The updates also include DNS, TLS and other fixes.

On 22 October, Imperva said it demonstrated code execution in a specific application configuration using the official Node.js 24.22.0 Linux arm64 build, requiring repeated attempts; the same input was rejected by 24.22.1. These are limited test results and do not mean every version and deployment has been successfully compromised.

Brotli is a shared compression component. Google has released fixes in 1.0.10, 1.1.1 and 1.2.1, while PyPA's 23 October advisory also confirms that Python brotlicffi requires version 1.2.1.0. Different software may bundle its own copy, so one update may not cover every service.

Next Steps for Businesses / Editorial Observations

After redeployment, verify the version actually running. Also check containers, build images and dependencies that extract externally supplied data.

Next steps you can take

  • Apply the security release or a later patched release for your Node.js branch, and arrange compatibility testing.
  • Inventory Brotli-related packages and bundled components, updating according to each project's advisory rather than relying only on a perimeter firewall.

Original sources

Reporting leads · The Hacker News · 3 reports consolidated

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

Wednesday, October 21, 2026 Security Releases

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42Original scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NET