Bug 2560779

Summary:	Missing CVE-2026-111497 Patch for NodeJS22
Product:	[Fedora] Fedora	Reporter:	customercare
Component:	nodejs22	Assignee:	Jan Staněk <jstanek>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	43	CC:	aradchen, jstanek, tjuhasz
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-27 11:37:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description customercare 2026-10-26 14:33:32 UTC

Releases: 43/44/45/46

Fixed in 22.23.4
Supplied version: 22.22.2 (F43)

caused by CVE-2026-111497 in Brotli Decoder

Request: CritPath Update to stable asap.

Note: it spread to python and other implementation. 

Source: 

https://broccoli2shell.com/

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

Comment 1 customercare 2026-10-26 18:22:05 UTC

from the devs who found the bug..

"Update October 26: Patches are now available for Node.js, Bun, Envoy, Istio, .NET, Python, Java brotli4j, libbrotli and several Linux distributions, including Debian, Alpine and Amazon Linux. Ubuntu, SUSE and the standard Red Hat Enterprise Linux repositories don’t have a fix yet. For Node.js (including 18 and 20) and Ubuntu, Aikido patched container images are available for free now, so you can stay on your current version. Check the table below for the status of each platform."

Fedora has NO SAFE version for any nodejs rdy and i did not check the rest.


‍

Comment 2 Jan Staněk 2026-10-27 11:37:49 UTC

All of the Fedora's NodeJS packages are compiled and dynamically linked against system libbrotli. Once the updates to brotli-1.2.1 [1] land in stable (already in place for rawhide/F45, on it's way for F44, still in testing for F43), NodeJS packages cease to be vulnerable without any additional action necessary.

[1]: https://bodhi.fedoraproject.org/updates/?packages=brotli

So closing this as NOTABUG, since there is nothing to do on NodeJS side in Fedora.