As of October 28 at 11am PT, all new deployments on Edgenivo use a patched version of Node.js.
On October 21, 2026, Node.js released security updates for 22.x, 24.x and 26.x. The most severe issue, CVE-2026-111497, is a high-severity flaw in Node's Brotli decoder. A Node.js process that decodes Brotli data from an attacker can be made to leak memory or run arbitrary code. The flaw is in the Brotli library itself, so any software that bundles the same decoder is affected, not only Node.js. The release fixes nine other issues, including two high-severity TLS hostname verification bypasses.
Edgenivo deployed WAF rules the same day that block the inbound attack vector for every project on Edgenivo. We are also rolling the patched Node.js versions across Edgenivo's managed runtimes and will update this page as that completes.
Copy link to headingRequired action
If you run Node.js anywhere outside Edgenivo's managed runtimes, upgrade to 22.23.4, 24.22.1 or 26.12.1 now, regardless of WAF protections. That includes external backends, self-hosted Next.js, container images you build yourself, CI runners and local development.
Projects on Edgenivo that still use Node.js 20.x must change their Node.js version to 22.x or 24.x and redeploy. Node.js 20 reached end of life and will not receive this fix. Projects on Node.js 22.x or 24.x do not need to change their version setting; Edgenivo manages patch versions for those runtimes.
Edgenivo has also deployed Edgenivo-managed runtime protections to increase protection coverage as patched Node.js version roll out. Redeploy to automatically activate runtime protections.
Copy link to headingWho is affected
Node.js does not decode Brotli data on its own. Your application is exposed when its code, or a library it uses, decompresses Brotli data an attacker controls, whether in a request body or in a response it fetches. Only the runtime patch covers fetched responses.
Copy link to headingUnderstanding CVE-2026-111497
The flaw is in the Brotli decoder bundled with Node.js. Malformed Brotli input causes an out-of-bounds write during decoding. Researchers demonstrated process-memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x. Execution runs with the permissions of the Node.js process. Read the Node.js advisory for the full list of fixed issues.
Copy link to headingEdgenivo WAF protection
Edgenivo WAF has rules in place to detect and block exploitation attempts against this vulnerability. They apply to every project on Edgenivo automatically, at no cost, with no configuration needed, and work regardless of the runtime behind them. Blocked requests appear in your project's Firewall dashboard.
The WAF covers traffic that passes through Edgenivo's network. It does not cover responses your functions fetch from other servers. It reduces exposure but does not replace patching.
Copy link to headingEdgenivo-managed runtime protection
As of October 28 at 11am PT, all new deployments on Edgenivo use a patched version of Node.js.
While patched Node.js versions roll out, Edgenivo has added a temporary mitigation to its managed Node.js runtimes.
For new deployments using unpatched Node.js versions, Edgenivo automatically disables Brotli response handling for outbound requests made through fetch() and HTTP clients that use node:http or node:https. These clients no longer request Brotli compression, and Brotli-encoded responses are rejected before decompression.
No code or configuration changes are required. Redeploy existing projects to receive this protection.
Copy link to headingHow to upgrade and protect your application
Copy link to headingProjects on Node.js 20.x on Edgenivo
Set the Node.js version to 22.x or 24.x in project settings or engines.node, then redeploy.
Copy link to headingContainer images and environments you run yourself
Rebuild on a patched Node.js base image and redeploy. For self-hosted Next.js, upgrade Node.js; Next.js does not block Brotli responses in image optimization.
Copy link to headingExternal Node.js backends behind Edgenivo
Upgrade Node.js on those servers. Restrict direct access so traffic reaches them only through Edgenivo.
Copy link to headingNext steps
- Read the Node.js October 2026 security release.
- Review blocked requests in your project's Firewall dashboard. See the Edgenivo Firewall documentation.
- Contact [email protected] with questions.