REPORTED DEVELOPMENT
Node.js released security updates addressing CVE-2026-111497 in the Brotli decoder, which can allow remote code execution when a vulnerable application decompresses attacker-controlled content. TLS certificate verification and DNS-request vulnerabilities were also corrected. Updated releases are 22.23.4, 24.22.1 and 26.12.1.
Vercel says WAF protections cover known attack methods but not necessarily content fetched from external servers or self-managed runtimes.
WHY IT MATTERS TO THE MARKET
Inbound traffic protection does not replace patching vulnerable software. Actual runtime versions across applications, services, containers and development environments determine exposure.