The release

Several fixes, one deployment question

The Node.js project published security updates for its 22.x, 24.x and 26.x lines: 22.23.4, 24.22.1 and 26.12.1. The highest severity in the release is High. Among the fixes is CVE-2026-111497, a Brotli decoder out-of-bounds write the project says can permit remote code execution. The release also addresses hostname-validation issues and updates its CA certificates for the eMudhra intermediate-CA incident.

Those are different problems and should not be collapsed into a single exploit story. The advisory does not say the Brotli flaw is being exploited in the wild. Applicability depends on the runtime branch and how an application uses the affected features.

Do not stop at package.json

A declared engine version or updated base image does not change a process already running in an old container. Verify the version inside the deployed service after rebuild and restart.

Defender workflow

Track the runtime through the release pipeline

  1. 1

    Locate the copies. Inventory servers, containers, serverless deployments, CI runners and vendor products that bundle Node.js. Include systems that do not use the organisation’s standard build pipeline.

  2. 2

    Update and redeploy. Move supported 22.x, 24.x and 26.x installations to the fixed releases, rebuild images, restart services and confirm the live binary version.

  3. 3

    Check edge cases. Review whether exposed services process compressed input and whether custom trust stores or TLS hostname handling need separate testing. Follow vendor advisories for packaged products.

Defender note

A version report is useful only when tied to a workload

Make the closure record say which service and instance now runs which Node.js version. That gives responders a way to find exceptions later and keeps this release from becoming another “patched” ticket that never reached production.