Skip to main content

Security bulletin: Node.js vulnerability CVE-2026-111497

On October 21, 2026, the Node.js project disclosed CVE-2026-111497, a high-severity vulnerability in the Node.js Brotli decoder that may allow remote code execution when processing malicious compressed data.

Smartsign has completed an assessment of the vulnerability:

  • The customer-facing Smartsign cloud service is not affected.
  • Some supporting microservices used affected Node.js versions. These services have been updated to patched versions.
  • Smartsign on-premises products are not affected.

No action is required from Smartsign customers.