Node.js ships emergency fix for high-severity Brotli decoder RCE in v22/24/26
cramforce · x · 2026-10-22
Node.js released security updates for 22.x, 24.x and 26.x. The most severe issue, CVE-2026-111497, is a high-severity flaw in the Brotli decoder: a process decoding attacker-supplied Brotli data can leak memory or execute arbitrary code. The release also fixes nine other issues, including two high-severity TLS hostname verification bypasses.
Vercel deployed WAF rules the same day to block known exploit patterns and is rolling patched Node versions across its managed runtimes — but stresses WAF is not a substitute for patching. Anyone running Node outside Vercel's managed runtimes (self-hosted Next.js, custom containers, CI runners, local dev) should upgrade now to 22.23.4, 24.22.1 or 26.12.1. Vercel projects still on end-of-life Node 20.x must switch to 22.x/24.x and redeploy.
More from Infra
- 8x NVIDIA DGX Spark cluster with 200GB switch becomes SF's new flex — beffjezos · 2026-10-22
- NVIDIA Cosmos-3-Nano world models go live on Reactor's robot inference cloud — chris_j_paxton · 2026-10-22
- Abacus.AI CEO beta-tests GPU-hosted apps on SuperComputer, runs 3D flying-car game — bindureddy · 2026-10-22
- 2-bit draft in VRAM + exact residual in RAM: speculative decoding for models that don't fit your GPU — Happy_Guitar3521 · 2026-10-22
- Seroter's daily list: OpenAI models land on Google Cloud, PHP CVEs, Genkit Go 1.14 — rseroter · 2026-10-22
- inference.net tops OpenRouter third-party hosts at 14% share, serving ~10% of daily volume — Ronangmi · 2026-10-22