# Node.js Brotli Bug Allows RCE, and Vercel's WAF Only Covers Inbound

> Source: <https://firerun.io/nodejs-brotli-rce-vercel-waf-2026/>
> Published: 2026-10-23 00:00:00+00:00

# Node.js Brotli Bug Allows RCE, and Vercel's WAF Only Covers Inbound

Node.js fixed a high-severity Brotli decoder flaw, CVE-2026-111497. Vercel's WAF blocks inbound attacks but not responses a function fetches.

Node.js released security updates Oct. 21 that fix a high-severity flaw in its Brotli decoder, CVE-2026-111497, where malformed compressed data triggers an out-of-bounds write that can end in remote code execution. Vercel said the same day that its firewall blocks the inbound attack path for every project. The rule does not cover everything.

[The Node.js October 2026 security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) lists the bug as affecting the 22.x, 24.x and 26.x lines. Patched versions are 22.23.4, 24.22.1 and 26.12.1. The release fixes nine other issues, including two high-severity TLS certificate hostname bypasses. The Node.js project credited OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with the Brotli report.

## What Vercel Said

In a security bulletin dated Oct. 21, Vercel said researchers demonstrated process-memory disclosure and command execution on unpatched 22.x, 24.x and 26.x. Code runs with the permissions of the Node.js process.

Node.js does not decode Brotli on its own. An app is exposed when its code, or a library it uses, decompresses Brotli data an attacker controls, whether in a request body or in a response the app fetches.

Vercel said it deployed WAF rules the same day, automatically and at no cost. Blocked requests show up in a project’s Firewall dashboard. The rules cover only traffic passing through Vercel’s network. They do not cover responses a function fetches from other servers. Only the runtime patch closes that path. Vercel is rolling patched Node.js versions across its managed runtimes.

Projects on Node.js 20.x need to move. That version reached end of life and will not get a fix. Switch to 22.x or 24.x and redeploy. Projects already on 22.x or 24.x need no settings change. Vercel manages patch versions for those runtimes.

## Outside Vercel’s Runtimes

Vercel said anyone running Node.js elsewhere should upgrade now, regardless of the WAF. That includes external backends behind Vercel, self-hosted Next.js, container images, CI runners and local development. It noted that Next.js does not block Brotli responses in image optimization.

Security firm Aikido, in an Oct. 22 write-up it titled “Node2Shell,” said Bun users running apps that decompress attacker-controlled Brotli are also affected. Aikido’s read is wider than Vercel’s. Vercel’s bulletin speaks only to Node.js.

## Firerun’s Take

The WAF is a good default and a poor reason to wait. Vercel says it reduces exposure and does not replace patching. The fetched-response path sits outside it. Treat any service that decompresses third-party Brotli as exposed until it runs a patched build.

## Key Takeaways

- Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1.
- Vercel’s WAF blocks inbound exploit patterns only; fetched responses need the runtime patch.
- Node.js 20.x projects on Vercel must move to 22.x or 24.x and redeploy.