Repository navigation
blog: October 2026 security releases - #2553
Merged
Merged
Conversation
✅ Deploy Preview for expressjscom-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
UlisesGascon
commented
Oct 27, 2026
Comment on lines
+61
to
+86
| ## A note on Brotli decompression (CVE-2026-111497) | ||
|
|
||
| Google recently published [CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497), an out-of-bounds write in the Brotli decoder, which raised community concern about its impact on the Express ecosystem. Node.js bundles this decoder, and Express applications that accept Brotli-compressed request bodies reach it: with default options, `express.json()`, `express.urlencoded()`, and the other body parsers decompress a `Content-Encoding: br` request body through Node's `zlib.createBrotliDecompress()`. | ||
|
|
||
| As the Express project, our recommendation is to **upgrade Node.js** to a release that ships the patched Brotli decoder. That is the real fix. Only if you cannot upgrade Node for some reason, and your application does not need Brotli-compressed request bodies, use a workaround like the following to reject them at the edge before any body parser runs: | ||
|
|
||
| ```js | ||
| // Register before every body parser or decompression middleware. | ||
| app.use((req, res, next) => { | ||
| const encoding = (req.get('Content-Encoding') || 'identity') | ||
| .trim().toLowerCase(); | ||
|
|
||
| if (!['identity', 'gzip', 'deflate'].includes(encoding)) { | ||
| return res.status(415).send( | ||
| 'Use gzip, deflate, or an uncompressed request body.' | ||
| ); | ||
| } | ||
| next(); | ||
| }); | ||
|
|
||
| // Keep your existing parser options and register routes afterward. | ||
| app.use(express.json()); | ||
| app.use(express.urlencoded({ extended: true })); | ||
| ``` | ||
|
|
||
| Thanks to [Patch the Planet](https://patchtheplanet.org/brotli) for reporting the impact on the Express ecosystem and for the write-up and workaround. |
Member
Author
There was a problem hiding this comment.
cc: @jonchurch @ctcpip @sheplu I think this covers what we discussed yesterday but feel free to make changes!
bjohansebas
approved these changes
Oct 27, 2026
UlisesGascon
force-pushed
the
blog/october-2026-security-releases
branch
from
October 30, 2026 18:43
e856ee4 to
0a412cc
Compare
Member
Author
|
Just updated the file date and I plan to merge it in 12h aprox from now 👍 |
UlisesGascon
marked this pull request as ready for review
October 30, 2026 18:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
👉 PREVIEW LINK
Security releases blog post for October 2026.
CVEs covered:
Also includes a defense-in-depth note on the upstream Brotli decoder vulnerability (CVE-2026-111497), recommending a Node.js upgrade with a middleware fallback.
Notes:
CVE-2026-111181post #2545 merges.