CVE-2026-111497: is your Node.js affected?
SeverityHighNode.js
Fixed upstream
Linux packages and images
All fixed versionsRows with a fixed, not affected, waiting or fix pending state. Unconfirmed rows, end-of-life releases and third-party repositories are in the full table of Node2Shell.
Debian
| Release | Package | Fixed version | State | Verified | Source |
|---|---|---|---|---|---|
| 12(bookworm) security (LTS team) | brotli | 1.0.9-2+deb12u1 | Fixed | Source | |
| 13(trixie) security | brotli | 1.1.0-2+deb13u1 | Fixed | Source | |
| 12(bookworm) security (LTS team) | nodejs | No fixed version published yet | No fix yet | Source | |
| 13(trixie) security | nodejs | No fixed version published yet | No fix yet | Source | |
| sid(unstable) | brotli | No fixed version published yet | No fix yet | Source | |
| forky(testing) | brotli | No fixed version published yet | No fix yet | Source | |
| forky(testing) | nodejs | No fixed version published yet | No fix yet | Source | |
| sid(unstable) | nodejs | No fixed version published yet | No fix yet | Source |
Debian builds Node.js against the system Brotli library; the fix ships in the brotli package. Source: “nodejs uses system provided brotli library”
CISA Known Exploited Vulnerabilities (KEV)
Not in the KEV catalog as of catalog version 2026.10.23, checked . KEV catalog
How to check your system
Find the version you run: the upstream release for a source or vendor build, or the package version for a distribution package.
Compare it with the row for your own release line or distribution above. A distribution package is judged by its own version string, never by the upstream number.
Or paste the output into the version checker. It runs in your browser and sends nothing.
Hosting providers, platform guides and the change log are on the page for Node2Shell.
Sources
- CVE record · CVE Program
- Upstream release or advisory · nodejs.org · Last checked
Downloads and release details Node.js v22.23.4 Node.js v24.22.1 Node.js v26.12.1
- KEV catalog · CISA · Last checked