Can’t Patch Node.js Yet? Build a Stopgap with the Controls You Own

Step 1: Find and Prioritize Exposed Node.js
Step 2: Apply Interim Mitigations
Step 3: Add Layers from the Security Stack You Already Run
Step 4: Patch, Restart, and Re-Validate
Where to Start
Coming Next: Give Your Controls Credit in Qualys ETM

Executive Summary

Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run end-of-life lines that will never receive a fix. In the meantime, interim mitigations from the Qualys Threat Research Unit narrow the Brotli, DNS, TLS, and keep-alive attack paths, and WAF, IPS, and EDR protections from major vendors add further layers. Soon, Qualys ETM will factor these controls into risk scores. These controls buy time, but upgrading the runtime remains the only complete fix.

Node.js comes with a clear instruction: upgrade the runtime. The October 21 security release fixes 10 vulnerabilities, including CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, and three high-severity flaws that weaken DNS and TLS hostname validation. Fixed releases exist for the 22.x, 24.x, and 26.x lines. Upgrading at this scale still takes time, because the vulnerable code lives in the runtime itself, in container images, single-executable applications, and serverless functions that dependency checks never touch. In Qualys telemetry, only 42,000 of the 3.3 million installations have been patched so far, and 1.7 million run end-of-life versions, including 25.x, 23.x, 21.x, and 20.x, that will not receive a fix and must move to a supported line.

Those first days are where mitigations and compensating controls earn their place. They reduce risk while upgrades roll out, and the right visibility shows which runtimes need attention first. Our Node.js blog post covers vulnerabilities, fixed versions, and detection methods.

Here is how to bridge the gap between disclosure and upgrade, in four steps: find and prioritize exposed Node.js, apply interim mitigations, layer the controls you already run, then patch and verify.

Step 1: Find and Prioritize Exposed Node.js

Qualys customers can search for assets affected by CVE-2026-111497 and the other October 2026 Node.js CVEs to see every Node.js runtime across hosts, containers, and cloud workloads. That includes copies that dependency checks miss, such as those in version managers, application folders, and bundled runtimes.

It is important to note that not every vulnerable runtime has the same level of exposure. Start with internet-facing services that decompress untrusted Brotli data (CVE-2026-111497), since they are the most direct path to remote code execution. Services that open TLS connections to user-supplied hosts (CVE-2026-106069, CVE-2026-105483) come next. Runtimes on end-of-life lines need an upgrade plan, as no patches will be available for them. Consider these factors alongside business criticality to decide what to mitigate and upgrade first.

Step 2: Apply Interim Mitigations

Node.js has no official workaround, but the Qualys Threat Research Unit has identified practical interim steps. Each one narrows a specific attack path while you plan the upgrade, and together they complement the fix.

These changes do not eliminate all exploitation paths associated with these CVEs, and some changes may affect application behavior. Therefore, it is crucial to test the affected applications after each change.

Limit Brotli exposure (CVE-2026-111497). Avoid decompressing Brotli from untrusted sources where you can, and cap payload size and decompression ratio at the reverse proxy or WAF.
Use the safer DNS call (CVE-2026-105482). Resolve user-supplied names with dns.lookup instead of dns.resolve*, and reject hostnames that contain NUL characters.
Canonicalize IP addresses (CVE-2026-106069, CVE-2026-105483, CVE-2026-106072). Convert addresses to canonical form before they reach a TLS connection, and reject fullwidth and other non-canonical forms.
Turn off keep-alive for untrusted servers (CVE-2026-105481). Disable keepAlive on http.Agent for connections to servers you do not control.
Treat the Permission Model as advisory. (CVE-2026-106071, CVE-2026-106073) Do not rely on it as a security boundary on affected versions.

Step 3: Add Layers from the Security Stack You Already Run

The tools already in your environment can work alongside the interim steps, each at a different point in the attack path. Each layer can catch what the one before it misses.

Edge and network: WAF and IPS. WAF and IPS vendors such as Cloudflare, Fortinet, and Check Point have released protections that name the Brotli flaw. They help block exploit requests before those requests reach the Node.js decoder.

After exploitation: EDR. Behavioral and exploit-prevention policies in endpoint tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and Cortex XDR add a second line of defense. They help stop what an attacker tries next, such as a Node.js process spawning a shell or downloading a binary, and some also act on the memory exploitation itself.

Node.js 3rd-party Mitigation and Compensating Controls

The table below lists the rules and policies each vendor has released for CVE-2026-111497 and the related Node.js CVEs, ready to copy into your console.

Layer	Vendor	Control	CVEs	How it helps
Edge (WAF)	Cloudflare	Managed rule 8f252673b6 9d47afb21f8 8acca706f3c, Brotli – Request Content-Encoding	CVE-2026-111497	Matches inbound requests that declare Content-Encoding: br. It ships in Log mode, so set it to Block.
Network (IPS)	FortiGate	IPS signature 62703	CVE-2026-111497	Blocks the crafted request inline before it reaches the decoder.
Network (IPS)	Check Point	Advisory CPAI-2026-15802	CVE-2026-111497	Blocks the exploit attempt at the gateway.
Host (EDR)	CrowdStrike	Suspicious Process Prevention (Linux, macOS, Windows)	CVE-2026-111497, 106070, 106071, 106073	Blocks a Node.js process that spawns shells, downloaders, or newly written binaries after exploitation.
Host (EDR)	CrowdStrike	ASLR Bypass Prevention (Windows)	CVE-2026-111497	Blocks the ASLR bypass a reliable Brotli exploit needs. Requires Additional User Mode Data.
Host (EDR)	Microsoft Defender for Endpoint	Behavior Monitoring (Windows, Linux, macOS)	CVE-2026-111497, 106070, 106071, 106073	Inspects process ancestry and autostart changes to catch follow-on activity after exploitation.
Host (EDR)	Cybereason	Exploit Protection Mode (Windows)	CVE-2026-111497	Applies per-process memory-exploit mitigations.
Host (EDR)	SentinelOne	Anti Exploitation / Fileless (Windows)	CVE-2026-111497	Behavioral AI that detects in-memory exploitation inside the Node.js process.
Host (EDR)	Cortex XDR	Known Vulnerable Processes Protection (Linux, macOS, Windows)	CVE-2026-111497	Injects exploit-prevention logic into the Node.js process. Effective only if Node.js is in the protected process set.
Host (EDR)	Cortex XDR	Credential Gathering Protection (Linux, macOS)	CVE-2026-106071, 106073	Blocks unauthorized reads of credential stores, such as SSH keys and password files, that a Permission Model bypass could reach.

Coverage is strongest for the Brotli flaw. The Cloudflare rule keys on the Content-Encoding header, so it covers requests that declare Brotli, not compressed data a service fetches or unpacks from other sources. The DNS and TLS hostname flaws depend on the interim steps above and on the upgrade.

Note: Rule and policy IDs are as published by each vendor in October 2026; confirm them in your console. The endpoint policies act after exploitation or on memory behavior, so verify each one fires for your Node.js process. Compensating controls reduce risk; upgrading Node.js remains the only complete fix.

Step 4: Patch, Restart, and Re-Validate

Interim mitigations reduce risk. Upgrading remains the only complete fix. Node.js fixed these flaws in 22.23.4, 24.22.1, and 26.12.1, while lines such as 25.x, 23.x, 21.x, 20.x, and older receive no fix and must move to a supported release. Customers can deploy supported vendor patches through TruRisk Eliminate, so check the patch catalog for their line. Qualys reports a high patch reliability rating for these updates and no OS reboot requirement for the runtime upgrade.

Confirm That Remediation Is Complete

A patch isn’t finished when the package installs:

Upgrade every copy. Migrate end-of-life lines to a supported release.
Rebuild container images and single-executable applications on the fixed version, then redeploy them.
Restart every service that runs on Node.js. Long-running processes, containers, and single-executable applications keep the vulnerable runtime in memory until they restart.
Rescan and verify. Rescan with Cloud Agent or Container Security and confirm the detection QIDs are closed.

Where to Start

Find. Search for CVE-2026-111497 and the other October 2026 Node.js CVEs to locate every runtime, including copies outside standard install paths.
Prioritize. Put internet-facing services that decompress untrusted Brotli data at the top, alongside business criticality.
Mitigate. Apply the Qualys TRU interim steps to runtimes awaiting an upgrade, and test the affected applications.
Layer. Keep applicable WAF, IPS, and EDR protections enabled and current as additional layers, and set the Cloudflare rule to Block.
Patch and verify. Upgrade to a fixed release, rebuild and redeploy what embeds the runtime, restart every Node.js service, and rescan.

Compensating controls buy valuable time, but they do not remove the flaw. Keep tracking every system until it is patched.

Coming Next: Give Your Controls Credit in Qualys ETM

The capabilities described in this section are in development and subject to change.

Two servers can run the same unpatched Node.js build and carry very different risks. One sits behind a WAF rule and an IPS signature that name the Brotli flaw, with EDR watching its Node.js process. The other faces the internet with nothing in front of it. A traditional scan reports them the same way.

Qualys ETM is being extended to close that gap. It arrives in three steps:

Recommendations on every finding (coming soon). ETM will show which applicable third-party controls can reduce exposure for each vulnerability, so teams know what to enable and where.
Controls reflected in the score. Controls that are in place will lower a finding’s QVSS score to reflect your actual defenses, shown as the Environmental score, so remediation queues focus on what still needs attention.
Action from the same platform. Teams will be able to apply third-party mitigations through TruRisk Eliminate from the platform that found the exposure.