Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerability in Node.js

23 October 2026

Attackers can exploit a critical vulnerability affecting Node.js to execute arbitrary code remotely or disclose sensitive information on affected systems. Patch immediately.

Background

Security updates have been released for Node.js to address a critical vulnerability (CVE-2026-111497) in the Brotli decoder component. The vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 9.8 out of 10. 

Impact

Successful exploitation of this out-of-bounds write vulnerability could allow an attacker to execute arbitrary code remotely or disclose sensitive information from the memory of affected systems. Exploitation requires an affected application to decompress attacker-controlled Brotli-compressed data.

Affected Products

The vulnerability affects the following Node.js versions:

  • Node.js 22.x versions prior to 22.23.4

  • Node.js 24.x versions prior to 24.22.1

  • Node.js 26.x versions prior to 26.12.1

Recommendations

Users and administrators of affected products are advised to update to the latest security versions immediately.

References

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases (opens in new tab)

https://vercel.com/kb/bulletin/node-js-security-advisory (opens in new tab)

https://www.tenable.com/cve/CVE-2026-111497 (opens in new tab)