Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

A critical out-of-bounds write vulnerability (CVE-2026-111497) in Node.js's bundled Brotli decoder enables remote code execution across multiple active Node.js versions, affecting containers, serverless functions, and single executable applications alike. Unlike typical application-layer dependency vulnerabilities, this flaw lives in the runtime itself, meaning standard package manager updates (e.g., npm audit fix) will not remediate it — organizations must upgrade the Node.js runtime directly. This distinction catches many teams off guard because their existing software composition analysis (SCA) tools may not inventory runtime binaries alongside application dependencies. The breadth of affected deployment models amplifies the attack surface, as overlooked container base images or serverless runtimes can remain vulnerable long after a patch is available.