A critical vulnerability (CVE-2026-111497) was discovered in the Brotli decoder within Node.js, allowing for potential memory corruption, disclosure, or remote code execution. This bug affects Node.js versions 22, 24, and 26, though Node 20 will not receive a fix. The issue stems from the decoder attempting to append data past an eight-byte internal buffer when encountering an invalid block switch. Researchers from OpenAI Codex Security reported the flaw, and Imperva successfully demonstrated code execution on a stock Node.js image.The vulnerability can be triggered by either compressed responses fetched by Node.js applications or Brotli-encoded request bodies processed by frameworks like Express 5. While code execution required multiple attempts in testing, a crash leading to denial of service or limited memory reads is more easily achievable. The official Node.js security advisory rates the bug as "high," not "critical," despite some outlets assigning a higher CVSS score.Fixes are available in Node.js versions 22.23.4, 24.22.1, and 26.12.1. Crucially, Node 20 and older versions are end-of-life and will not receive patches, necessitating an upgrade. The update also addresses nine other CVEs, including high-severity TLS and DNS issues.Organizations are urged to audit all Node.js instances, including those embedded in container images, CI runners, and VMs, as these are often overlooked. A provided check-node.mjs script can help identify vulnerable Node.js versions. Developers should also review their code for direct Brotli decompression calls.While WAFs like Vercel's can block inbound attacks, they don't protect against malicious Brotli in responses fetched by Node.js, highlighting the continued need for patching. This vulnerability underscores the importance of a comprehensive understanding of deployed runtimes, a topic addressed in the author's book, "Ship It." The author also develops Hermes IDE, an AI-powered IDE for developers.