Node.js has shipped security updates to fix a high-severity vulnerability that could let an attacker run arbitrary code on a server simply by sending it malformed compressed data, and Vercel has moved to shield its customers while developers scramble to patch.
The Node.js project released updates on October 21 for the 22.x, 24.x and 26.x release lines, fixing ten separate security issues. The most serious of them, tracked as CVE-2026-111497, is a flaw in Node’s built-in Brotli decoder. A Node.js process that decompresses Brotli data supplied by an attacker, whether from an incoming request body or a fetched response, can be tricked into an out-of-bounds memory write. Researchers demonstrated that this can leak process memory or lead to full remote code execution, running with whatever permissions the Node.js process has.
Brotli is a compression format used widely across the web, so the exposure isn’t limited to niche setups. Any application whose code, or whose dependencies, decompress Brotli data from an untrusted source is a potential target.
Vercel’s Response
Vercel, which hosts a large share of the world’s Next.js and Node.js applications, said it deployed Web Application Firewall rules on the same day to block the inbound attack vector across every project on its platform, automatically and at no extra cost. It is also rolling the patched Node.js versions out across its managed runtimes.
Despite that, Vercel was explicit in its advisory that the WAF is not a substitute for patching. It only covers traffic that passes through Vercel’s own network, not responses that an application’s functions fetch independently from other servers. Teams running Node.js anywhere outside Vercel’s managed runtimes, including external backends, self-hosted Next.js deployments, custom container images, CI runners and local development environments, are being told to upgrade immediately regardless of the WAF protection. Projects still pinned to the end-of-life Node.js 20.x, which will not receive this fix at all, need to move to 22.x or 24.x and redeploy.
What Else Got Fixed
The October 21 release wasn’t just about the Brotli bug. It also patched two other high-severity issues involving TLS certificate hostname verification, where a certificate could be made to pass validation for the wrong host, along with several medium- and low-severity bugs touching keep-alive sockets, IPv4 hostname parsing, Node’s permission model, and the entropy cache behind crypto.randomUUID() and randomInt(). The release also bundled dependency updates for c-ares, OpenSSL, SQLite, Undici, and for the root CA certificate store, after the compromise of an eMudhra intermediate certificate authority that has separately wiped out roughly ₹1,450 crore of the Indian company’s market value in the past two days.
Part Of A Rough Week For Web Infrastructure
The Node.js advisory lands in the middle of what has already been a turbulent stretch for internet infrastructure. It follows close on the heels of PHP’s emergency patch for two critical flaws after exploit details leaked online, a bug serious enough that Japan’s prime minister and the US FBI both issued public warnings about it. Cloudflare’s CEO said exploit attempts against that PHP flaw jumped from thousands to millions within hours of disclosure, while cloud deployment platform Railway separately disclosed a breach that may have exposed customer secrets and paused deployments.
AI tools are increasingly part of how these bugs come to light, too: OpenAI has said its GPT-5.6 Sol model helped flag one of the critical PHP vulnerabilities that triggered the scramble.
For now, the fix for the Node.js flaw is straightforward: upgrade. But with vulnerabilities surfacing across the stack, from the language runtime to the CA system to the frameworks built on top of it, security teams are unlikely to get much of a breather.