Update this weekBrotli / Node.jsDeveloper, data & AI tools

A bug in a common compression library puts Node.js apps at risk

Who's affected: Apps that unpack Brotli-compressed data, especially Node.js servers. Cloud security firm Wiz found vulnerable systems in 91% of cloud environments.
Under attack?: Early signs only. Honeypots have logged a few attempts, apparently from a mass-scanning group. Whether you're exposed depends on how your app handles compressed data.
What to do: Upgrade Node.js; there is no workaround. Bun, Envoy, Python, .NET and PHP on Windows have also shipped fixes.
Fixed in: Node.js 22.23.424.22.126.12.1
CISA deadline: Federal agencies must fix this by Nov 10, 2026. Everyone else should treat that as a ceiling, not a target.

CVE-2026-111497Severity score 9.2/10Chance of attack in 30 days: 88% (EPSS)Listed Oct 27, 2026Source: The Hacker News ↗

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: Brotli / Node.js

Hi [Client name],

Attackers are actively exploiting a security flaw in Brotli / Node.js.

Who's affected: Apps that unpack Brotli-compressed data, especially Node.js servers. Cloud security firm Wiz found vulnerable systems in 91% of cloud environments.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Upgrade Node.js; there is no workaround. Bun, Envoy, Python, .NET and PHP on Windows have also shipped fixes.

Fixed in: Node.js 22.23.4, 24.22.1, 26.12.1
Reference: CVE-2026-111497 – https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

A bug in a common compression library puts Node.js apps at risk

Also under attack in Developer, data & AI tools