24/10/2026
Another security vulnerability worth checking.
CVE-2026-111497 affects Google's Brotli decompression library, including versions bundled with Node.js and Bun.
The vulnerability allows specially crafted compressed data to cause memory corruption, potentially leading to information disclosure, application crashes or remote code ex*****on.
Security updates are available:
- Node.js 22.23.4
- Node.js 24.22.1
- Node.js 26.12.1
- Bun 1.4.4
The important point here is that updating your operating system's Brotli library doesn't necessarily fix applications that bundle their own vulnerable copy.
Check your installed versions, update affected applications and remember that software built with vulnerable bundled libraries may also need rebuilding.
Official Node.js advisory:
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases