Do you decompress Brotli data that comes from outside with node:zlib? If so, you are hit by the only one of the ten flaws in Node.js's October 21 bulletin that can lead to code execution. If not, read on: two of the other High ones are about something else.
Fact
The facts: on October 21, 2026 Node.js published a bulletin with ten vulnerabilities: four High, three Medium and three Low. The severities are Node.js's own labels. Fixes are in v22.23.4, v24.22.1 and v26.12.1. CVE-2026-111497 (High) is in the Brotli decoder: according to Node.js, malformed compressed input writes past the end of an internal decoder buffer and can lead to a crash, disclosure of process memory or remote code execution. It is triggered when an application decompresses attacker-supplied Brotli data with node:zlib. It affects 26.x, 24.x and 22.x. Two more High concern certificate checks against an IP address: CVE-2026-105483 (an address written with fullwidth digits is not recognized as an IP and is matched against the DNS names in the certificate; affects 26.x and 24.x) and CVE-2026-106069 (a leading zero in IPv4 is read as octal by the certificate check, while the resolver on some systems, such as macOS, reads it as decimal, so the wrong address can be authenticated; affects 26.x, 24.x and 22.x). The fourth High is about DNS and a name with a NUL byte. The bulletin mentions no attacks.
The condition decides everything. Count where you accept compressed data from outside people or from someone else's server. Only there does the flaw have a path to you.
What matters is whose data you decompress, not whether you use Brotli.
The other two High are twins in meaning: a certificate check against an IP address that can authenticate the wrong one. It is easy to skip, because both live in oddly written addresses, with fullwidth digits or a leading zero. If your application connects by IP and the address arrives as text from outside, this is your case.
Among the dependencies updated in the same bulletin is the list of trusted certificates (ca-cert), with a note about the compromised eMudhra intermediate certificates.
This I do not know. Whether other projects using Brotli are affected, the bulletin does not say: it speaks about the decoder in Node.js.
The version of your line must be at least v22.23.4, v24.22.1 or v26.12.1; if it is lower, updating is your next task. If your line is not on the list (26, 24, 22), Node.js writes that end-of-life versions are affected every time a release like this ships.
Official primary sources
Node.js - October 2026 security releases (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069), 21.10.2026The visual is generated code-art, no third-party images.