Fedora Account System
Red Hat Associate
Red Hat Customer
Releases: 43/44/45/46 Fixed in 22.23.4 Supplied version: 22.22.2 (F43) caused by CVE-2026-111497 in Brotli Decoder Request: CritPath Update to stable asap. Note: it spread to python and other implementation. Source: https://broccoli2shell.com/ https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
from the devs who found the bug.. "Update October 26: Patches are now available for Node.js, Bun, Envoy, Istio, .NET, Python, Java brotli4j, libbrotli and several Linux distributions, including Debian, Alpine and Amazon Linux. Ubuntu, SUSE and the standard Red Hat Enterprise Linux repositories don’t have a fix yet. For Node.js (including 18 and 20) and Ubuntu, Aikido patched container images are available for free now, so you can stay on your current version. Check the table below for the status of each platform." Fedora has NO SAFE version for any nodejs rdy and i did not check the rest.
All of the Fedora's NodeJS packages are compiled and dynamically linked against system libbrotli. Once the updates to brotli-1.2.1 [1] land in stable (already in place for rawhide/F45, on it's way for F44, still in testing for F43), NodeJS packages cease to be vulnerable without any additional action necessary. [1]: https://bodhi.fedoraproject.org/updates/?packages=brotli So closing this as NOTABUG, since there is nothing to do on NodeJS side in Fedora.