Node.js Brotli RCE and October 2026 security releases: what to check

Node.js patched a Brotli decoder RCE (CVE-2026-111497) on October 21, 2026. See the patched versions, how Upsun updated its images, what to check in your projects, and what to do if your app uses the Node.js bundled in a PHP, Ruby, Java, or Rust image.

In short:

• Impact on Upsun: Defense in depth (ASLR and a read-only filesystem) makes the Brotli flaw (CVE-2026-111497) harder to exploit on Upsun. Only a patched Node.js version fixes it.
• nodejs:22, nodejs:24, nodejs:26: Patched images are available. Redeploy your environment to get the fix: Upsun doesn’t apply it automatically.
• nodejs:20 or earlier: End of life, no patch. Upgrade to Node.js 22, 24, or 26.
• php:8.5: Bundles the patched Node.js 24.22.1. Redeploy your environment to get it.
• php:8.4, ruby:3.3, java:21, rust:1: Bundle Node.js 20 (Node.js 18 on rust:1). Install a patched version now with a build hook. On February 1, 2027, Upsun will update these images with a patched Node.js version and redeploy your environments.
• php:8.3 and earlier: Bundle an end-of-life Node.js (20 in php:8.3, 18 in php:8.2, 12 or earlier in php:8.1 and below) that won’t get a patch. Upgrade to php:8.5.

On October 21, 2026, the Node.js project released Node.js 26.12.1, 24.22.1, and 22.23.4. These versions fix several vulnerabilities across the 26.x, 24.x, and 22.x release lines. The most notable is a high-severity flaw in the Brotli decoder that can lead to remote code execution (RCE): CVE-2026-111497. For the full list, see the Node.js security release. Upsun has updated its Node.js images to the patched versions.

Update history

• October 28, 2026: Clarified the impact on Upsun. Added the February 1, 2027 patch and redeploy date for the Node.js bundled in the php:8.4, ruby:3.3, java:21, and rust:1 images, and steps to install a patched version now.
• October 22, 2026: First published.

What was fixed

The release fixes multiple vulnerabilities across the active release lines. The highest severity is high: there’s no critical-rated issue in this release. The one that stands out is a Brotli decoder flaw that can permit remote code execution.

CVE	Description	Severity	Affected lines
CVE-2026-111497	Brotli decoder out-of-bounds write that permits remote code execution.	High	26.x, 24.x, 22.x
CVE-2026-105482	dns.resolve truncates names that contain a NUL character.	High	26.x, 24.x, 22.x
CVE-2026-105483	TLS certificate hostname bypass when the IP is written with fullwidth digits.	High	26.x, 24.x
CVE-2026-106069	TLS certificate hostname bypass when the host loosely resolves to an IP address.	High	26.x, 24.x, 22.x

The release also fixes several medium- and low-severity issues and updates bundled dependencies such as c-ares, OpenSSL, SQLite, and Undici, and removes a compromised certificate authority. For the complete list and credits, see the Node.js security release.

How the Brotli RCE works

Brotli is a compression format that Node.js can decompress, for example when it handles HTTP responses or requests that use Brotli content encoding. CVE-2026-111497 is a memory-safety bug in that decoder: when it processes crafted compressed input, it can write past the end of a buffer (an out-of-bounds write). An attacker who controls the compressed data an app decompresses could use it to crash the process, read its memory, or potentially run code. Any app that decompresses untrusted Brotli data is potentially exposed, even if its own code is secure. For the public record, see CVE-2026-111497 on CVE.org and in the National Vulnerability Database (NVD).

The flaw is in the Brotli library that Node.js bundles, so updating your framework or dependencies doesn’t fix it: only a patched Node.js version does.

On Upsun, defense in depth makes the flaw harder to exploit. Address space layout randomization (ASLR) places code at random memory addresses, and the read-only application filesystem prevents changes to your app at runtime. Only a patched Node.js version fixes the flaw.

Affected and patched versions

The following table maps each active Node.js line on Upsun to its patched version:

Node.js line	Status on Upsun	Patched version
26	Active	26.12.1
24	Active	24.22.1
22	Active	22.23.4

All three active lines are affected and have official patched releases.

End-of-life Node.js versions

Node.js 20 and earlier are end of life upstream and don’t receive these fixes. On Upsun, these are Sunset versions: they keep working, but they won’t get a patched image. See Image statuses for what each status means.

If you run Node.js 20 or earlier, upgrade to an active version (22, 24, or 26).

Node.js bundled in PHP, Ruby, Java, and Rust images

Some Upsun runtime images also include a Node.js version, for example, to build assets. The following table shows when each image gets a patched Node.js version, and which newer image you can upgrade to now:

Runtime image	Bundled Node.js	Patched image and redeploy	Upgrade now to
php:8.5	24	Available now: redeploy to get Node.js 24.22.1	No upgrade needed
php:8.4	20	February 1, 2027	php:8.5 (Node.js 24)
ruby:3.3	20	February 1, 2027	ruby:4.0 (Node.js 24) or ruby:3.4 (Node.js 22)
java:21	20	February 1, 2027	java:25 (Node.js 24)
rust:1	18	February 1, 2027	No newer image: install a patched version in your build hook

Earlier php images also bundle an end-of-life Node.js version (20 in php:8.3, 18 in php:8.2, and 12 or earlier in php:8.1 and below) and won’t get a patched one.

See If you use Node.js bundled in a PHP, Ruby, Java, or Rust image.

How Upsun responded

As soon as the Node.js project published the patched versions, Upsun updated its Node.js images for the active lines (22, 24, and 26). The updated images are live. Upsun also updated the php:8.5 image, which bundles Node.js 24, to Node.js 24.22.1. Upsun isn’t forcing a redeploy for these images: your project picks up the patched image the next time its environment deploys.

For the php:8.4, ruby:3.3, java:21, and rust:1 images, Upsun will update the bundled Node.js to a patched version and redeploy your environments on February 1, 2027.

What you need to do

What you need to do depends on where your app gets Node.js:

• From a nodejs runtime image
• From the Node.js bundled in a php, ruby, java, or rust image

If you use a nodejs image

Redeploy to get the patched image

If your app uses nodejs:22, nodejs:24, or nodejs:26, the patched image is already available. Trigger a redeploy of your environment to get it. Any new push or deployment also picks it up.

Check your Node.js version

After your environment redeploys, confirm the Node.js version your app runs:

  upsun ssh --environment main --app myapp -- node -v

Replace main with your environment name and myapp with your app name. If your project has a single app, you can omit --app. The output should show a patched version from the table above. If it shows an older version on a nodejs image, your environment hasn’t redeployed yet. On a php, ruby, java, or rust image, an older version is expected and a redeploy doesn’t change it. See If you use Node.js bundled in a PHP, Ruby, Java, or Rust image.

If you run an end-of-life version

If your app runs Node.js 20 or earlier, no patched image is available. Upgrade to an active version by changing the type of your app in your configuration file, for example:

  applications:
    myapp:
      type: "nodejs:24"

To pin or manage a specific Node.js version, see Manage Node.js versions.

If you use Node.js bundled in a PHP, Ruby, Java, or Rust image

By default, an app on a php, ruby, java, or rust image uses the Node.js version bundled in that image. This covers build hooks, asset builds, dependencies.nodejs packages, and any node command your app runs. To see which version your image bundles, see Node.js bundled in PHP, Ruby, Java, and Rust images.

If your app uses php:8.5: Its bundled Node.js 24.22.1 is patched. Redeploy your environment to get it.

If your app uses php:8.4, ruby:3.3, java:21, or rust:1: These images bundle Node.js 20 or 18. On February 1, 2027, Upsun will update these images with a patched Node.js version and redeploy your environments.

• PHP, Ruby, Java, and Rust: Upsun recommends that you install a patched Node.js version now, rather than wait. Rust has no newer image to upgrade to, so use Option 2 below.

The flaw affects your app in two ways, depending on when your app runs Node.js:

• At runtime, on untrusted input: For example, to fetch URLs or decompress data that users send. Crafted input can trigger the flaw.
• Only in your build hook: Your build doesn’t process user input, but it still runs an unpatched Node.js version.

To install a patched version now, check your Node.js version, and then choose one of the following options.

Option 1: Upgrade your runtime version. A newer image bundles an active Node.js line:

• php:8.4: Upgrade to php:8.5 (Node.js 24). PHP 8.5 is largely backward compatible with PHP 8.4. See the PHP 8.5 migration guide.
• ruby:3.3: Upgrade to ruby:4.0 (Node.js 24) or ruby:3.4 (Node.js 22). Upsun recommends Ruby 4.0, because Node.js 22 reaches end of life upstream on April 30, 2027.
• java:21: Upgrade to java:25 (Node.js 24).

To upgrade, change the type of your app in your configuration file, for example:

  applications:
    myapp:
      type: "java:25"

Push the change to a preview environment, test it, and then merge. Then check your Node.js version again.

If your app runs PHP 8.3 or earlier, upgrading to PHP 8.5 also moves it off a deprecated or retired PHP version. This upgrade involves more changes, so test it carefully.

Option 2: Install a patched Node.js version and keep your current runtime. Use a version manager such as n to install the Node.js version you choose in your build hook. It might not work on php:8.1 and earlier, because these images run on older systems: upgrade to PHP 8.5 instead.

1. Create a .nvmrc file in your app root with an active Node.js line (22, 24, or 26). Upsun recommends Node.js 24 or 26, because Node.js 22 reaches end of life upstream on April 30, 2027. For example:

   .nvmrc

     24
   

2. Add n as a dependency, set N_PREFIX, and install the version at the start of your build hook:

     applications:
       myapp:
         type: "ruby:3.3"
         dependencies:
           nodejs:
             n: "*"
         variables:
           env:
             N_PREFIX: /app/.global
         hooks:
           build: |
             set -e
             # Install the version from .nvmrc
             n auto
             # Recognize the newly installed version
             hash -r
             # Your existing build steps
   

   Keep your current runtime in type. Run n auto before any build step that uses Node.js.

3. Push the change to a preview environment, test it, and then merge.

4. Check your Node.js version. It should show a patched version from the table above.

For more options, including nvm, see Manage Node.js versions.

Outside Upsun

Upgrade Node.js to the patched versions anywhere else you run it, including:

• Local development machines
• Docker images
• CI pipelines

Acknowledgments

Thanks to the Node.js project and its security team for coordinating the disclosure and shipping these fixes. The Brotli decoder issue (CVE-2026-111497) was reported by mcollina and fixed by aduh95. For the full list of reporters and fixers, see the Node.js security release.

Questions

If you have questions about your project, contact Upsun support.