Rule snapshot: 2026-10-23. Covered identifier: CVE-2026-111497.
The Node.js project describes an out-of-bounds write in its bundled Brotli
decoder. Applications that decompress attacker-controlled Brotli input through
node:zlib can expose process memory to corruption, with possible crashes,
memory disclosure, or code execution. Node.js rates this issue high severity.
See the official advisory.
This checker compares reported runtime versions with published upstream fixes.
It does not trigger the decoder, send compressed request bodies, test a crash,
or attempt code execution. Exploitability is always not_tested.
| Supported line in this snapshot | First fixed release | Release notes |
|---|---|---|
| 22.x | 22.23.4 | Node.js 22.23.4 |
| 24.x | 24.22.1 | Node.js 24.22.1 |
| 26.x | 26.12.1 | Node.js 26.12.1 |
These are the October 21, 2026 security releases. Comparisons are branch-specific:
24.22.0 is below its fix, 24.22.1 meets it, and 24.23.0 also meets it.
The checker does not download rules or silently refresh this table.
| Evidence | Result | Interpretation |
|---|---|---|
| One complete plain version below its branch's fix | potentially_affected |
Reported upstream base is older than the fix; validate deployed package/build and exposure. |
| One complete plain version at/above its branch's fix | fixed_version_reported |
Version comparison meets the table; actual deployment and package patches remain unverified. |
| Plain version on an older unsupported upstream line | unsupported_runtime |
No upstream fix threshold for this line is supplied by this snapshot; obtain vendor guidance or upgrade. |
| Missing, malformed, partial, or conflicting versions | unknown |
There is not one usable runtime version to compare. |
| Vendor-qualified, prerelease, or custom-build evidence | unknown |
The upstream number alone cannot establish patch status. |
| Inconsistent decoder metadata or possible backport evidence | unknown |
Reconcile the binary and build provenance before accepting an upstream-version verdict. |
| An uncovered future branch | unknown |
Update rules from official evidence before assessing it. |
A leading v is accepted for ordinary Node.js version output. Qualifiers are
preserved rather than stripped to produce a more reassuring comparison.
Conflicting versions are not reduced to the newest or oldest value.
The Node.js release schedule
and advisory identify the importance of supported releases. An
unsupported_runtime result is an upgrade/review finding, not a claim that this
checker reproduced CVE-2026-111497 on every historical Node.js release.
Only explicit Node.js version disclosures are version candidates. A public header can be stale, spoofed, generated by a proxy, or inconsistent across a load-balanced service. It is never independent runtime attestation.
Express, Next.js, or similar framework indicators are hints. A framework version is not a Node.js version. HTML assets can come from a static export or a different host. Missing indicators do not establish that Node.js is absent.
A response header such as Content-Encoding: br does not establish that the
application accepts or decodes attacker-controlled Brotli request bodies. The
checker requests identity encoding and does not decompress the response.
--node-version compares a supplied version without making network requests.
The operator is responsible for obtaining that value from the relevant runtime.
A version copied from a Dockerfile, development machine, deployment label, or
package manifest may differ from the process actually serving traffic.
collect-runtime.cjs records metadata for the Node.js process executing the
collector. Run it in the actual container or runtime environment you intend to
assess. A host installation does not describe every container, function, worker,
or separately bundled runtime.
The collector does not prove how a vendor built or patched the binary. Its
build_source is unknown by default. Brotli metadata is useful context, but
does not override the Node.js release table or establish that a backport is
present. The checker does not infer exploitability from collected metadata.
The collector also records whether Brotli decompression APIs and the
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH constant are present. It does not call
the decompression APIs. A reported constant value of -17 below the upstream
version threshold is treated as possible backport/custom-build evidence and
keeps the assessment unknown. Conflicting detailed metadata likewise prevents
a fixed-version result. A missing constant in sparse metadata does not by
itself prove a vulnerability; a constant's presence does not prove a complete
patch or establish which binary serves application traffic.
- Identify each deployed Node.js runtime, including container images, workers, serverless functions, and binaries that embed Node.js.
- Check its actual version and package/build provenance. Consult the vendor for backports or customized runtimes rather than assuming the upstream version is the complete patch record.
- Update affected supported lines to their fixed release or a newer maintained release. Move unsupported upstream runtimes to a supported line.
- Rebuild and redeploy affected images or artifacts, restart the serving processes, and collect the version again from the deployed environment.
- Review paths that decompress untrusted Brotli input. The checker does not perform that source/configuration review or verify a compensating control.
A successful scan, a missing header, or a WAF response does not establish that a service has been patched. Keep operational fetch failures separate from the version result, and preserve the original evidence when reviewing a finding.
The assessment is for Node.js versions. It does not apply Node.js thresholds to Bun, browser runtimes, standalone Brotli libraries, or arbitrary packages with a similar version number. It is not a general vulnerability scanner and does not claim to assess all vulnerabilities fixed in the same security release.
Rules and fixed versions come from these primary sources:
- Node.js October 2026 security releases
- Node.js v22.23.4 release notes
- Node.js v24.22.1 release notes
- Node.js v26.12.1 release notes
- Node.js release schedule
Related reporting supplied for this project:
- Imperva: Node2Shell, from Brotli data to remote code execution
- Dynatrace: Node2Shell Node.js Brotli vulnerability
- Security Boulevard: what to patch and how to find exposed services
Update this document, the embedded rule date/table, and focused boundary tests together when newer official evidence changes the assessment.