NCSC warns of serious vulnerability in Node.js
A flaw in the Brotli decoder could, under certain conditions, allow remote code execution.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
The Netherlands’ National Cyber Security Centre is warning of a vulnerability in the Brotli decoder, which is used in Node.js among other things. The NCSC assesses the likelihood of exploitation as moderate, but describes the potential damage as significant.
According to the NCSC, the vulnerability is registered as CVE-2026-111497. An attacker could, according to the NCSC, have specially crafted, compressed data processed by a vulnerable system. This could lead to a disruption, the reading of data from process memory or the execution of code with the privileges of the affected programme.
The Node.js project released security updates for versions 22, 24 and 26. The affected release lines have been updated to 22.23.4, 24.22.1 and 26.12.1 respectively. Organisations using older, no longer supported versions would do well to have them checked for vulnerabilities as well.
The problem lies in the Brotli decompression library. Brotli is used to make web data smaller before it is sent. Node.js is a widely used platform for running JavaScript outside the browser, including for servers and web applications.
In addition to the Brotli flaw, the Node.js security release contained several other fixes. These include issues involving DNS resolution and TLS certificate verification. The Node.js project classifies the most serious issues as high, but the NCSC is specifically warning about the Brotli vulnerability.
The NCSC reports that, at the time of its warning, there was no evidence of active exploitation. The absence of evidence of active exploitation does not mean that systems without the update are safe.
For Dutch organisations, the main practical conclusion is that they should check whether Node.js or an underlying dependency is being used and then install the appropriate security update. Those who do not know which version is running can have this checked by their own IT service provider. The notification is not an indication that all websites or apps using JavaScript are automatically vulnerable.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The technical core was checked directly with the NCSC and the Node.js project. The article avoids claiming that active exploitation is taking place.
- confirmed Under certain conditions, the vulnerability could lead to denial of service, data leaks or code execution. — The NCSC describes these possible consequences. source
- confirmed Node.js released updates for the 22, 24 and 26 lines. — The Node.js project names these release lines and versions. source
- confirmed The NCSC has not reported any evidence of active exploitation. — That is stated in the NCSC warning. source
Editor's note
The vulnerability, the affected versions and the available updates have been confirmed by the NCSC and the Node.js project. According to the NCSC, active exploitation has not been established.Sources
- Kwetsbaarheid in Google Brotli-decoder in Node.js: update nu — Nationaal Cyber Security Centrum
- Wednesday, October 21, 2026 Security Releases — Node.js Project