#Node.js

Brotli CVE-2026-111497 extends beyond Node.js to Python, .NET and PHP dependencies

Brotli's CVE-2026-111497 is now in CISA's exploited-vulnerability catalogue. Exposure depends on the decoder and data path, with distinct fixes for Node.js, Python, .NET and PHP Windows builds.

Node.js October security release fixes Brotli memory corruption, TLS validation and DNS flaws

Node.js fixes ten vulnerabilities across supported release lines, including Brotli memory corruption, hostname verification errors and repeated random values in application snapshots.