On October 26, 2026, Fortinet published advisory FG-IR-26-187, which lists ten Node.js vulnerabilities affecting the 22.x, 24.x and 26.x branches. The advisory is marked as critical (CVSSv3 9.8) and includes more than 40 Fortinet products whose status is still under investigation. The most dangerous of the listed vulnerabilities — CVE-2026-111497 — enables remote code execution via an out-of-bounds write in the Brotli decoder and has already been added to the CISA KEV catalog with a remediation deadline of November 10, 2026. Organizations using Fortinet products or Node.js need to immediately assess their exposure and update their runtimes.
Ten vulnerabilities: what was fixed in the October Node.js release
On October 21, 2026, the Node.js project released security updates that fix 10 vulnerabilities. According to Qualys, four of them are high severity:
- CVE-2026-111497 (High) — an out-of-bounds write in the Brotli decoder that can lead to process memory corruption, data leakage or remote code execution. Affects Node.js 22.x, 24.x and 26.x.
- CVE-2026-105482 (High) — truncation of DNS resolution in the presence of embedded NUL characters. Affects 22.x, 24.x and 26.x.
- CVE-2026-105483 (High) — bypass of TLS hostname validation using full-width digits. Affects 24.x and 26.x.
- CVE-2026-106069 (High) — bypass of TLS hostname validation with non-canonical IP addresses. Affects 22.x, 24.x and 26.x.
Three more vulnerabilities (CVE-2026-105481, CVE-2026-106072, CVE-2026-106074) are medium severity and affect all three branches. Three low-severity vulnerabilities (CVE-2026-106070, CVE-2026-106071, CVE-2026-106073) primarily affect 26.x.
The fixed Node.js versions are: 22.23.4, 24.22.1 and 26.12.1, according to the official Node.js advisory.
CVE-2026-111497: from vulnerability to exploitation in a matter of days
The central vulnerability in the advisory — CVE-2026-111497 — deserves special attention because of the rapid shift from disclosure to active exploitation. We have already examined this vulnerability in detail in the context of its impact on the Brotli ecosystem.
An important nuance in the severity assessment: Node.js assigns CVE-2026-111497 a High rating, whereas Rapid7 and Qualys report a CVSS 9.2 Critical score from the CNA. In its advisory, Fortinet states CVSSv3 9.8, but this value relates to the metadata of the multi-vulnerability document and is associated with CVE-2026-106069 — applying it to all ten CVEs is incorrect.
The exploitation timeline changed rapidly. According to Rapid7, as of October 26, 2026, no active exploitation had been observed. However, already on October 27 CISA added CVE-2026-111497 to the KEV catalog, and the company Previdian recorded an exploitation attempt on its sensors. It should be emphasized: Previdian’s telemetry records an attempt at exploitation, not a confirmed compromise — there is currently no data on successful attacks or victims.
As Rapid7 notes, exploitation is only possible when an application decompresses attacker-controlled data in Brotli format via the node:zlib module. This means not every Node.js service is equally at risk — the level of threat is determined by whether there is a path that processes untrusted Brotli data.
Scale of impact on Fortinet products
Advisory FG-IR-26-187 lists more than 40 Fortinet products with the status “under investigation”, including FortiOS, FortiProxy, FortiSIEM, FortiMail, FortiSandbox, FortiNAC, FortiEDR, FortiSASE and many others. This does not mean that all listed products are vulnerable — the investigation is ongoing.
At the same time, Fortinet has confirmed that a number of products are not affected: FortiManager, FortiAnalyzer, FortiClient (EMS, iOS, macOS, Windows), FortiAuthenticator, FortiWeb, FortiSOAR, FortiCamera and others. Organizations using Fortinet products need to monitor updates to the advisory to obtain the final status for each product.
Fortinet is far from the only vendor assessing the impact. Advisories for CVE-2026-111497 have been published by Cisco, F5, Red Hat, Ubuntu, Amazon Linux, Envoy Proxy, Bun, Microsoft .NET and others. According to Wiz, 91% of cloud environments in their dataset contain resources vulnerable to CVE-2026-111497, and 82% have publicly accessible Node.js instances. These figures reflect Wiz’s sample and are not a universal estimate, but they do indicate the scale of the potential attack surface.
Practical recommendations
Patch priority should be determined by how reachable the vulnerable code is:
- Highest priority — internet-exposed services that process untrusted Brotli data (web servers supporting Content-Encoding: br, API gateways, proxies). Update Node.js to versions 22.23.4, 24.22.1 or 26.12.1.
- High priority — services that perform outbound DNS queries or TLS connections based on user-supplied data (relevant for CVE-2026-105482, CVE-2026-105483, CVE-2026-106069).
- Standard priority — internal services that do not process external data.
Critically important: as Qualys notes, the vulnerable code resides in the Node.js runtime itself, not in application packages. Standard dependency checks via npm audit may fail to detect the issue. The inventory must cover containers, single-executable applications (SEA), serverless functions, environments managed by version managers, and embedded copies of the runtime.
Node.js does not provide workarounds — updating is the only complete way to remediate. Organizations using end-of-life Node.js versions must migrate to a supported branch. For Fortinet product users — monitor updates to advisory FG-IR-26-187 to obtain the final status for each product. The remediation deadline required by CISA for U.S. federal agencies is November 10, 2026; commercial organizations would be well advised to aim for the same timeframe.
