The latest official security releases for Node.js 22.23.4, 24.22.1, and 26.12.1 resolve a high-severity exploit in the software’s bundled Brotli decoder. Identified as CVE-2026-111497, the out-of-bounds write vulnerability allowed attackers to corrupt memory and execute arbitrary code on servers by providing malicious compressed data. Administrators are urged to upgrade and restart affected services, as end-of-life versions of the runtime will not receive these upstream updates.
Vercel had already implemented Web Application Firewall rules and firewall-level mitigations across all its project deployments to block the exploit before the official Node.js patches were issued. The company is continuing to roll out managed runtime upgrades to protect all deployment traffic automatically.
