Bulletin ID: 2026-155-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/28/2026 15:00 PM PDT

Description:

AWS is aware of CVE-2026-111497, a buffer overflow in the native Brotli decompression library, first addressed in the Node.js October 2026 security releases. Decoding specially crafted Brotli-compressed input could allow a third party to run code or read process memory in an affected application. The issue affects Brotli decoding beyond Node.js, and fixes from other vendors are not yet fully available.

The information for affected AWS Services is provided below. We will update this bulletin as more information becomes available.

Current Mitigation Status:

AWS Lambda

The AWS Lambda managed service is not affected. The Lambda runtimes for .NET and Node.js are affected by this issue.

Lambda runtimes for Python, Ruby and OS-only provided.al2023 do not include the Brotli library. If you include the Brotli library in your own function deployment in these situations, we recommend redeploying with a patched version.

• Status by runtime:
  - Node.js 22, 24, 26 - Container base images: Updated. Rebuild and redeploy now. - ZIP packages, Phase 1: October 28, 2026 - ZIP packages, Phase 2: October 30, 2026- .NET 8, 9 (container only), 10 - Container base images: Target October 28, 2026 - ZIP packages, Phase 1: October 29, 2026 - ZIP packages, Phase 2: October 31, 2026
• Node.js:
  - Node.js 22 and 26: Rollout has started. Phase 1 is complete in eu-south-1, eu-west-1, ap-southeast-4 and us-east-2. Remaining regions will follow the schedule above.
  - Node.js 24: An update addressing this CVE will begin rollout on October 27, with completion targets as above. Because of a known regression in the Node.js 24.22.1 release, we are applying targeted updates to the current stable release rather than moving to the latest Node.js release.
• Note that deprecated runtimes, including Node.js 18 and 20, do not receive security updates. We recommend that customers update to a newer version.
• Applying the update:
  - Container images: Once the updated base image is available, rebuild and redeploy your container image functions from the latest base image.
  - ZIP packages: Managed runtime updates roll out in two phases:
       ○ Phase 1: Lambda applies the updated runtime when you create or update a function (via the UpdateFunctionCode or UpdateFunctionConfiguration API)
       ○ Phase 2: Lambda automatically updates functions using Auto runtime update mode that have not yet received the update

These phases roll out in waves across AWS regions. We are accelerating our usual release process, so we cannot forecast when deployment to individual regions will be completed.

Once Phase 1 is complete, you can pick up the patched runtime version by updating your function code or configuration. A zero-change update is not sufficient. An easy way to trigger a change is to add an environment variable. The following bash script uses the AWS CLI to add or update the TRIGGER_RUNTIME_UPDATE environment variable while preserving existing environment variables.

# 1. Set your function name FUNCTION_NAME="my-function" # 2. Read the current env vars into a JSON string CURRENT_VARS=$(aws lambda get-function-configuration \ --function-name "$FUNCTION_NAME" \ --query "Environment.Variables" \ --output json) # 3. Merge in the new variable MERGED=$(echo "$CURRENT_VARS" \ | jq ' if . == null then {} else . end | if .TRIGGER_RUNTIME_UPDATE then .TRIGGER_RUNTIME_UPDATE = ((.TRIGGER_RUNTIME_UPDATE | tonumber) + 1 | tostring) else .TRIGGER_RUNTIME_UPDATE = "1" end ') # 4. Update the function configuration aws lambda update-function-configuration \ --function-name "$FUNCTION_NAME" \ --environment "{\"Variables\": $MERGED}"

• How to verify your function is updated: The runtime patch version is reported in the INIT_START line in your function logs. This line is emitted on each execution environment cold start and usually appears at the top of each log stream. For Node.js, look for nodejs:22.mainline.v157 or higher (Node.js 22) or nodejs:24.mainline.v114 or higher (Node.js 24). The process.version property does not reflect the update for Node.js 24. We will update this message with patched version numbers for .NET before Phase 1 is complete..

AWS Amplify

AWS Amplify Hosting compute (Server-Side Rendering) applications running on Node.js 22 and Node.js 24 will receive the security update automatically once the underlying managed runtime is updated. No customer action is required.

If your runtime configuration specifies a Node.js version earlier than 22, we advise migrating to a supported Node.js version (22 or 24) to receive this and future security updates.

AWS App Runner

An updated App Runner managed Node.js runtime was deployed to all AWS Regions on 2026-10-26.

Services that have not been deployed since 2026-10-26: Redeploy your service once. The next deployment picks up the updated runtime with no configuration change.

Services pinned to an explicit older runtime version: Update the runtime version pin first, then redeploy. A redeploy alone will not move a pinned service to the updated runtime.

Amazon CloudWatch Synthetics

Node.js canaries: Node.js canary runtimes use the Lambda managed runtime and receive the same Phase 1 and Phase 2 updates described above. No action is required for canaries that receive automatic runtime updates (target: October 30, 2026).

Python Selenium canaries: The Python Selenium canary runtime includes the Brotli library. An update is in progress. We will update this bulletin with the patched runtime version and any customer action when it is available.

AWS CodeBuild

• Updated CodeBuild curated images are in progress. Target completion: 2026-10-30. The updated images include Node.js 22.23.4, 24.22.1, and 26.12.1; Ubuntu libbrotli1 1.0.9-2ubuntu0.1 / 1.1.0-2ubuntu0.1; and Amazon Linux 2023 brotli 1.1.0-1.amzn2023.0.2.
• Curated images using the latest tag with "Always use the latest image" selected, and on-demand AMI builds: No action required. Your next build uses the updated image.
• Curated images pinned to a specific version or digest: Update the reference to the updated image.
• Custom images built from a CodeBuild curated base image: Rebuild your image from the updated base image.
• Buildspecs that select Node.js 18 or 20: Updated images no longer include Node.js 18 or 20. Update your buildspec to use Node.js 22, 24, or 26.

AWS Elastic Beanstalk

• Elastic Beanstalk Node.js platform version 6.11.12, which includes Node.js 24.22.1 and 22.23.4, was released on October 22, 2026.
• To verify, run node --version, dpkg-query -W libbrotli1 (Ubuntu), or rpm -q brotli (Amazon Linux 2023) in your build.
• Environments with managed platform updates enabled: Your environment is updated to the fixed platform version during your next weekly maintenance window. To update sooner, apply the update from the Managed updates tab in the Elastic Beanstalk console.
• All other environments: Update your environment to platform version 6.11.12 or later.
• Environments on Node.js 18 or 20: Migrate to a supported Node.js platform branch.

To verify, run node --version on your environment instances.

AWS Elemental MediaLive

• AWS is updating an AWS-managed MediaLive component that includes the affected library. No customer action is required

Customer-managed Node.js environments

If you run and manage your own Node.js builds on AWS, for example on Amazon EC2 instances or in your own containers on Amazon ECS or Amazon EKS, you are responsible for updating those environments. Upgrade to Node.js 22.23.4, 24.22.1, 26.12.1, or later. Because this issue extends to other languages and applications that decode Brotli, also check whether your libraries and applications include Brotli decoding as a dependency.

Mitigation using AWS WAF

If you cannot update immediately, you can use AWS WAF to deploy a custom rule that blocks inbound requests that use Brotli content encoding (the Content-Encoding: br header). Before you deploy, note:

• AWS WAF inspects inbound requests only. This control does not cover Brotli data from other sources, such as responses from upstream services.
• Blocking Brotli-encoded requests blocks all Brotli-encoded uploads to the application, including normal traffic.
• The rule is an example and may not match every Brotli-encoded request. 
• Recommended deployment steps:
  1. Deploy the rule with the Count action.
  2. Review matched requests in Amazon CloudWatch metrics and in sampled requests.
  3. When you confirm that the rule doesn't affect normal traffic, change the action to Block. To do this, replace "Count": {} with "Block": {}.
  4. Set the rule priority to fit your existing rule order.

Example AWS WAF rule:

{   "Name": "Node2Shell_BROTLI",   "Priority": 2,   "Statement": {     "RegexMatchStatement": {       "RegexString": "^\\s*br\\s*$",       "FieldToMatch": { "SingleHeader": { "Name": "content-encoding" } },       "TextTransformations": [ { "Priority": 0, "Type": "LOWERCASE" } ]     }   },   "Action": { "Count": {} },   "RuleLabels": [ { "Name": "Node2Shell_Brotli" } ],   "VisibilityConfig": {     "SampledRequestsEnabled": true,     "CloudWatchMetricsEnabled": true,     "MetricName": "Node2Shell_BROTLI"   } }

To switch to blocking, replace "Count": {} with "Block": {}.

Updates to AWS Managed Rules are announced through the AWS WAF managed rule group SNS notifications and the AWS WAF Developer Guide.

Recommended actions

• Migrate workloads on end-of-life Node.js versions (including Node.js 18 and 20) to a supported version.
• For customer-managed environments, upgrade to a fixed Node.js release as part of your patch management process.
• Check whether your code, dependencies, or layers include their own Brotli library, and update them as fixes become available. If no patch is yet available for an affected library or application, disable Brotli decoding until one is released.

References:

• CVE-2026-111497
• Node.js October 2026 security releases

Please email aws-security@amazon.com with any security questions or concerns.