Node.js 26.12.1, 24.22.1 and 22.23.4 fix CVE-2026-111497, a high-severity Brotli decoder flaw that the Node.js project says permits remote code execution; Node.js 20 and older are end of life and will
In our lab on Node.js 22.23.3, the built-in fetch, axios, got and both node-fetch majors decoded a Brotli reply by default, and fetch did so even though it advertised only gzip and deflate.
Express 5.3.0 with body-parser 2.4.0 parsed a Brotli JSON request body while Express 4 with body-parser 1.20.9 returned HTTP 415, so exposure depends on whether untrusted Brotli bytes reach your