Node.js CVE-2026-111497: where untrusted Brotli reaches your app
The October 21, 2026 Node.js security releases fix CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that the project says can lead to remote code execution. The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Upgrading is the fix, and there's nothing to deba…