The Node.js Brotli vulnerability (CVE-2026-111497) had no impact on the Fireblocks platform or your assets. We upgraded to the patched Node.js versions across our infrastructure.
On October 21, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write in the Brotli decoder that permits remote code execution. It affects Node.js 22.x, 24.x, and 26.x. Fireblocks assessed the vulnerability as soon as the Node.js project disclosed it.
What you need to do
If you run your own Node.js applications, including custom software built on the Fireblocks SDK, upgrade to the patched version for your release line to address CVE-2026-111497: 22.23.4, 24.22.1, or 26.12.1.
For more details, see the Node.js security release announcement.