Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not […]
Read at Qualys Threat Research Unit
- Vendor
- Node.js
- Product
- Node.js
- EPSS
- 0.005 (p41)
- Fix
- available
- Exposure class
- Developer platform
Why it ranks 39 (Notable)
- EPSS 0.83 (high probability of exploitation)
- Product class: developer platform
- Covered by 21 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Qualys Threat Research Unit (blog.qualys.com)
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-105482 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-105483 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-106069 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-105481 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.