> ## Documentation Index
> Fetch the complete documentation index at: https://developer.upsun.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Node.js Brotli RCE and October 2026 security releases: what to check

> Node.js patched a Brotli decoder RCE (CVE-2026-111497) on October 21, 2026. See the patched versions, how Upsun updated its images, what to check in your projects, and what to do if your app uses the Node.js bundled in a PHP, Ruby, Java, or Rust image.

> [!NOTE]
>
> **In short:**
>
> * **Impact on Upsun:** Defense in depth (ASLR and a read-only filesystem) makes the Brotli flaw (CVE-2026-111497) harder to exploit on Upsun. Only a patched Node.js version fixes it.
> * **`nodejs:22`, `nodejs:24`, `nodejs:26`:** Patched images are available. [Redeploy your environment](#redeploy-to-get-the-patched-image) to get the fix: Upsun doesn't apply it automatically.
> * **`nodejs:20` or earlier:** End of life, no patch. [Upgrade to Node.js 22, 24, or 26](#if-you-run-an-end-of-life-version).
> * **`php:8.5`:** Bundles the patched Node.js 24.22.1. [Redeploy your environment](#redeploy-to-get-the-patched-image) to get it.
> * **`php:8.4`, `ruby:3.3`, `java:21`, `rust:1`:** Bundle Node.js 20 (Node.js 18 on `rust:1`). [Install a patched version now](#if-you-use-node-js-bundled-in-a-php-ruby-java-or-rust-image) with a build hook. On February 1, 2027, Upsun will update these images with a patched Node.js version and redeploy your environments.
> * **`php:8.3` and earlier:** Bundle an end-of-life Node.js (20 in `php:8.3`, 18 in `php:8.2`, 12 or earlier in `php:8.1` and below) that won't get a patch. [Upgrade to `php:8.5`](#if-you-use-node-js-bundled-in-a-php-ruby-java-or-rust-image).

On October 21, 2026, the Node.js project released Node.js 26.12.1, 24.22.1, and 22.23.4.
These versions fix several vulnerabilities across the 26.x, 24.x, and 22.x release lines.
The most notable is a high-severity flaw in the Brotli decoder that can lead to remote code execution (RCE): [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high).
For the full list, see the [Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).
Upsun has updated its Node.js images to the patched versions.

## Update history

* **October 28, 2026:** Clarified the impact on Upsun. Added the February 1, 2027 patch and redeploy date for the Node.js bundled in the `php:8.4`, `ruby:3.3`, `java:21`, and `rust:1` images, and steps to install a patched version now.
* **October 22, 2026:** First published.

## What was fixed

The release fixes multiple vulnerabilities across the active release lines.
The highest severity is **high**: there's no critical-rated issue in this release.
The one that stands out is a Brotli decoder flaw that can permit remote code execution.

| CVE | Description | Severity | Affected lines |
| - | - | - | - |
| [CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497) | Brotli decoder out-of-bounds write that permits remote code execution. | High | 26.x, 24.x, 22.x |
| [CVE-2026-105482](https://www.cve.org/CVERecord?id=CVE-2026-105482) | `dns.resolve` truncates names that contain a NUL character. | High | 26.x, 24.x, 22.x |
| [CVE-2026-105483](https://www.cve.org/CVERecord?id=CVE-2026-105483) | TLS certificate hostname bypass when the IP is written with fullwidth digits. | High | 26.x, 24.x |
| [CVE-2026-106069](https://www.cve.org/CVERecord?id=CVE-2026-106069) | TLS certificate hostname bypass when the host loosely resolves to an IP address. | High | 26.x, 24.x, 22.x |

The release also fixes several medium- and low-severity issues and updates bundled dependencies such as c-ares, OpenSSL, SQLite, and Undici, and removes a compromised certificate authority.
For the complete list and credits, see the [Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).

### How the Brotli RCE works

Brotli is a compression format that Node.js can decompress, for example when it handles HTTP responses or requests that use Brotli content encoding.
CVE-2026-111497 is a memory-safety bug in that decoder: when it processes crafted compressed input, it can write past the end of a buffer (an out-of-bounds write).
An attacker who controls the compressed data an app decompresses could use it to crash the process, read its memory, or potentially run code.
Any app that decompresses untrusted Brotli data is potentially exposed, even if its own code is secure.
For the public record, see [CVE-2026-111497 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-111497) and in the [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-111497).

The flaw is in the Brotli library that Node.js bundles, so updating your framework or dependencies doesn't fix it: only a patched Node.js version does.

On Upsun, defense in depth makes the flaw harder to exploit.
Address space layout randomization (ASLR) places code at random memory addresses, and the read-only application filesystem prevents changes to your app at runtime.
Only a patched Node.js version fixes the flaw.

## Affected and patched versions

The following table maps each active Node.js line on Upsun to its patched version:

| Node.js line | Status on Upsun | Patched version |
| - | - | - |
| 26 | [Active](https://developer.upsun.com/docs/languages/nodejs#active-versions) | 26.12.1 |
| 24 | [Active](https://developer.upsun.com/docs/languages/nodejs#active-versions) | 24.22.1 |
| 22 | [Active](https://developer.upsun.com/docs/languages/nodejs#active-versions) | 22.23.4 |

All three active lines are affected and have official patched releases.

### End-of-life Node.js versions

Node.js 20 and earlier are end of life upstream and don't receive these fixes.
On Upsun, these are [Sunset versions](https://developer.upsun.com/docs/languages/nodejs#sunset-versions): they keep working, but they won't get a patched image.
See [Image statuses](https://developer.upsun.com/docs/core-concepts/upgrade-runtimes-services.md#image-statuses) for what each status means.

**If you run Node.js 20 or earlier,** upgrade to an active version (22, 24, or 26).

### Node.js bundled in PHP, Ruby, Java, and Rust images

Some Upsun runtime images also include a Node.js version, for example, to build assets.
The following table shows when each image gets a patched Node.js version, and which newer image you can upgrade to now:

| Runtime image | Bundled Node.js | Patched image and redeploy | Upgrade now to |
| - | - | - | - |
| `php:8.5` | 24 | Available now: redeploy to get Node.js 24.22.1 | No upgrade needed |
| `php:8.4` | 20 | February 1, 2027 | `php:8.5` (Node.js 24) |
| `ruby:3.3` | 20 | February 1, 2027 | `ruby:4.0` (Node.js 24) or `ruby:3.4` (Node.js 22) |
| `java:21` | 20 | February 1, 2027 | `java:25` (Node.js 24) |
| `rust:1` | 18 | February 1, 2027 | No newer image: [install a patched version in your build hook](#if-you-use-node-js-bundled-in-a-php-ruby-java-or-rust-image) |

Earlier `php` images also bundle an end-of-life Node.js version (20 in `php:8.3`, 18 in `php:8.2`, and 12 or earlier in `php:8.1` and below) and won't get a patched one.

See [If you use Node.js bundled in a PHP, Ruby, Java, or Rust image](#if-you-use-node-js-bundled-in-a-php-ruby-java-or-rust-image).

## How Upsun responded

As soon as the Node.js project published the patched versions, Upsun updated its Node.js images for the active lines (22, 24, and 26).
The updated images are live.
Upsun also updated the `php:8.5` image, which bundles Node.js 24, to Node.js 24.22.1.
Upsun isn't forcing a redeploy for these images: your project picks up the patched image the next time its environment deploys.

For the `php:8.4`, `ruby:3.3`, `java:21`, and `rust:1` images, Upsun will update the bundled Node.js to a patched version and redeploy your environments on February 1, 2027.

## What you need to do

What you need to do depends on where your app gets Node.js:

* [From a `nodejs` runtime image](#if-you-use-a-nodejs-image)
* [From the Node.js bundled in a `php`, `ruby`, `java`, or `rust` image](#if-you-use-node-js-bundled-in-a-php-ruby-java-or-rust-image)

### If you use a `nodejs` image

#### Redeploy to get the patched image

If your app uses `nodejs:22`, `nodejs:24`, or `nodejs:26`, the patched image is already available.
Trigger a [redeploy](https://developer.upsun.com/docs/troubleshooting/general.md#force-a-redeploy) of your environment to get it.
Any new push or deployment also picks it up.

#### Check your Node.js version

After your environment redeploys, confirm the Node.js version your app runs:

```bash theme={null}
  upsun ssh --environment main --app myapp -- node -v
```

Replace `main` with your environment name and `myapp` with your app name.
If your project has a single app, you can omit `--app`.
The output should show a patched version from the [table above](#affected-and-patched-versions).
If it shows an older version on a `nodejs` image, your environment hasn't redeployed yet. On a `php`, `ruby`, `java`, or `rust` image, an older version is expected and a redeploy doesn't change it. See [If you use Node.js bundled in a PHP, Ruby, Java, or Rust image](#if-you-use-node-js-bundled-in-a-php-ruby-java-or-rust-image).

#### If you run an end-of-life version

If your app runs Node.js 20 or earlier, no patched image is available.
[Upgrade to an active version](https://developer.upsun.com/docs/languages/nodejs#active-versions) by changing the `type` of your app in your configuration file, for example:

```yaml {filename=".upsun/config.yaml"} theme={null}
  applications:
    myapp:
      type: "nodejs:24"
```

To pin or manage a specific Node.js version, see [Manage Node.js versions](https://developer.upsun.com/docs/languages/nodejs/node-version.md).

### If you use Node.js bundled in a PHP, Ruby, Java, or Rust image

By default, an app on a `php`, `ruby`, `java`, or `rust` image uses the Node.js version bundled in that image.
This covers build hooks, asset builds, [`dependencies.nodejs`](https://developer.upsun.com/docs/languages/nodejs#2-specify-any-global-dependencies) packages, and any `node` command your app runs.
To see which version your image bundles, see [Node.js bundled in PHP, Ruby, Java, and Rust images](#node-js-bundled-in-php-ruby-java-and-rust-images).

**If your app uses `php:8.5`:** Its bundled Node.js 24.22.1 is patched. [Redeploy your environment](#redeploy-to-get-the-patched-image) to get it.

**If your app uses `php:8.4`, `ruby:3.3`, `java:21`, or `rust:1`:** These images bundle Node.js 20 or 18.
On February 1, 2027, Upsun will update these images with a patched Node.js version and redeploy your environments.

* **PHP, Ruby, Java, and Rust:** Upsun recommends that you install a patched Node.js version now, rather than wait. Rust has no newer image to upgrade to, so use Option 2 below.

The flaw affects your app in two ways, depending on when your app runs Node.js:

* **At runtime, on untrusted input:** For example, to fetch URLs or decompress data that users send. Crafted input can trigger the flaw.
* **Only in your build hook:** Your build doesn't process user input, but it still runs an unpatched Node.js version.

To install a patched version now, [check your Node.js version](#check-your-node-js-version), and then choose one of the following options.

**Option 1: Upgrade your runtime version.** A newer image bundles an active Node.js line:

* **`php:8.4`:** Upgrade to `php:8.5` (Node.js 24). PHP 8.5 is largely backward compatible with PHP 8.4. See the [PHP 8.5 migration guide](https://www.php.net/manual/en/migration85.incompatible.php).
* **`ruby:3.3`:** Upgrade to `ruby:4.0` (Node.js 24) or `ruby:3.4` (Node.js 22). Upsun recommends Ruby 4.0, because Node.js 22 reaches end of life upstream on April 30, 2027.
* **`java:21`:** Upgrade to `java:25` (Node.js 24).

To upgrade, change the `type` of your app in your configuration file, for example:

```yaml {filename=".upsun/config.yaml"} theme={null}
  applications:
    myapp:
      type: "java:25"
```

Push the change to a [preview environment](https://developer.upsun.com/docs/glossary.md#preview-environment), test it, and then merge.
Then [check your Node.js version](#check-your-node-js-version) again.

If your app runs PHP 8.3 or earlier, upgrading to PHP 8.5 also moves it off a [deprecated or retired PHP version](https://developer.upsun.com/docs/languages/php#deprecated-versions).
This upgrade involves more changes, so test it carefully.

**Option 2: Install a patched Node.js version and keep your current runtime.** Use a version manager such as `n` to install the Node.js version you choose in your build hook.
It might not work on `php:8.1` and earlier, because these images run on older systems: upgrade to PHP 8.5 instead.

1. Create a `.nvmrc` file in your [app root](https://developer.upsun.com/docs/configure-apps/app-reference/single-runtime-image.md#root-directory) with an active Node.js line (22, 24, or 26).
   Upsun recommends Node.js 24 or 26, because Node.js 22 reaches end of life upstream on April 30, 2027.
   For example:

   ```text .nvmrc theme={null}
     24
   ```

2. Add `n` as a dependency, set `N_PREFIX`, and install the version at the start of your build hook:

   ```yaml {filename=".upsun/config.yaml"} theme={null}
     applications:
       myapp:
         type: "ruby:3.3"
         dependencies:
           nodejs:
             n: "*"
         variables:
           env:
             N_PREFIX: /app/.global
         hooks:
           build: |
             set -e
             # Install the version from .nvmrc
             n auto
             # Recognize the newly installed version
             hash -r
             # Your existing build steps
   ```

   Keep your current runtime in `type`. Run `n auto` before any build step that uses Node.js.

3. Push the change to a [preview environment](https://developer.upsun.com/docs/glossary.md#preview-environment), test it, and then merge.

4. [Check your Node.js version](#check-your-node-js-version). It should show a patched version from the [table above](#affected-and-patched-versions).

For more options, including `nvm`, see [Manage Node.js versions](https://developer.upsun.com/docs/languages/nodejs/node-version.md).

### Outside Upsun

Upgrade Node.js to the patched versions anywhere else you run it, including:

* Local development machines
* Docker images
* CI pipelines

## Acknowledgments

Thanks to the Node.js project and its security team for coordinating the disclosure and shipping these fixes.
The Brotli decoder issue (CVE-2026-111497) was reported by `mcollina` and fixed by `aduh95`.
For the full list of reporters and fixers, see the [Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).

## Questions

If you have questions about your project, [contact Upsun support](https://developer.upsun.com/docs/core-concepts/get-support.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.