Node.js released security updates on October 21, 2026 that fix CVE-2026-111497, a high-severity flaw in its Brotli decoder. An out-of-bounds write in the decoder can permit remote code execution. If Node.js runs anywhere in your environment, including the hosts where the Contrast Node.js agent runs, please update it.
This flaw sits in the Node.js runtime's own Brotli decoder, not in the applications running on it. Contrast protects application code by watching how untrusted data reaches things like SQL queries and system commands. A memory flaw inside the runtime happens below that layer, so the fix is an updated Node.js build.
If you cannot patch Node right away, a virtual patch in the Contrast Node.js agent (version 5.67.1 or later) can block one path to this flaw. Applications on Express 5 or body-parser 2.x decompress a request body when the request header Content-Encoding: br is present, which runs the vulnerable decoder. A virtual patch on the content-encoding request header with a Matches condition using the regular expression (?:^|,)\s*br\s*(?:;[^,]*)?(?:,|$) with ADR/Protect in blocking mode, stops those requests before the body is decoded.
This is a stopgap, not a fix. It blocks the inbound request path only. It does not cover a malicious response decoded by fetch() or a direct zlib.brotliDecompress() call, and it blocks all Brotli request bodies, legitimate ones included. Updating Node.js remains the complete fix.
Contrast's SaaS and EOP platforms run on Java. While some of our container images may include Node.js or Brotli libraries in their base layers, the platform does not use them at runtime. The only compression format the platform accepts is gzip, and requests using any other encoding are rejected, so the vulnerable code path is not reachable in our environment. We are tracking the CVE and will update affected base images as part of our normal patching cycle.
To update your Node.js build:
- Update to Node.js 26.12.1, 24.22.1, or 22.23.4, starting with internet-facing systems. The same releases fix nine other vulnerabilities and update the trusted certificate authority list, so the update covers more than this one flaw.
- If you run an end-of-life Node.js version, it is affected and will not receive a fix. Upgrade to a supported release.
- Update the Node.js runtime itself. Updating an application or a package does not patch the runtime. Restart your Node.js processes afterward and confirm the running version. If you use a container image or a hosting provider, check when they will ship a fixed build.
- Node.js has not published a workaround, indicators of compromise, or details on how the flaw is triggered. Until it does, review Node.js application logs and endpoint telemetry from October 21 forward for Node.js processes starting shells, running download tools, or making unexpected outbound connections. If you find any, isolate the host and start your incident response process.
Node.js's announcement is at https://nodejs.org/en/blog/vulnerability/october-2026-security-releases.
Questions? Go to your account manager or support@contrastsecurity.com.