October 26, 2026
On October 21, 2026, the Node.js project disclosed CVE-2026-111497, a critical flaw in the Brotli decompression library bundled with Node.js. We have patched the affected Shibumi component, and the fix is live in every environment and for every customer.
Vulnerability Overview
A malformed Brotli stream can trigger an out-of-bounds write, leading to a crash, memory disclosure or remote code execution. Fixed releases are Node.js 22.23.4, 24.22.1 and 26.12.1.
Remediation Response
Node.js at Shibumi is limited to our Presentation (AKA Snapshot) Service, which renders presentations to PDF. This service runs inside our private network and does not expose public-facing endpoints. The Presentation Service was upgraded to Node.js 24.22.1 with production container images rebuilt and deployed to production as part of patch 252.3 on Monday, October 26, 2026.
Questions
Contact your Shibumi account team or [email protected].