Strapi Projects Vulnerable to Critical Node.js Brotli Memory Corruption

Strapi v4 and v5 projects running on unpatched Node.js versions are vulnerable to CVE-2026-111497, a high-severity out-of-bounds write in the bundled Brotli decoder. Specially crafted requests can corrupt memory, expose process memory, cause a crash, or run code with process privileges via node:zlib.

Node.js released the fix on October 21, 2026, targeting lines 22.x, 24.x, and 26.x with versions 22.23.4, 24.22.1, and 26.12.1. The bug stems from an invalid block switch treated as a temporary need for more input rather than an error, causing the streaming decoder to append bytes to an eight-byte internal buffer. Node.js 20 and older will not receive a fix, and security vendors note that versions 25.x and 20.x remain vulnerable.

Self-hosted users must upgrade Node.js to a patched release matching their supported Strapi version and restart their apps. Strapi Cloud customers need to check the advisory for protections and redeployment steps, particularly for projects using a custom domain.

Exposure increases when applications decompress attacker-controlled Brotli data, such as request bodies, responses fetched via built-in fetch(), uploaded compressed files, or proxy traffic.

Teams can check versions with node --version on servers, CI runners, and inside containers. The upstream Brotli patch shipped in versions 1.2.1, 1.1.1, and 1.0.10.