Skip to main content

Security advisory: the Node.js runtime (CVE-2026-111497)

The Console and the REST Gateway run on a Node.js runtime that Tricryption ships with them. Node.js's security release of October 21, 2026 fixes CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles. CISA lists it as known to be exploited. The same release fixes several other defects in Node.js 24, among them TLS certificate host name validation bypasses (CVE-2026-105483, CVE-2026-106069).

Upgrade to release 8.1.0+3647.gafc556ab or later (Windows MSI product version 8.1.3647). It ships Node.js 24.22.2, which carries every fix in that security release. See the release notes.

What is affected​

ArtefactNode.js before the fixWhere the runtime is
Linux: the tricryption-node package24.18.0/opt/pisoft/tricryption/node/
Windows: the tricryption-console-gateway MSI24.18.0C:\Program Files\PiSoft\Tricryption\node\
The Gateway and Console container images24.18.0/opt/pisoft/tricryption/node/ inside the image

The key server, the remote engine and the C, C++ and Java SDKs contain no Node.js runtime and link no Brotli library. They are not affected.

What was measured about exposure​

The vulnerable code is the Brotli decoder. A process is exposed only if it decodes a Brotli stream that an attacker can supply. The Console and the REST Gateway were tested for that directly, on Node.js 24.18.0 and again on 24.22.2:

  • Request bodies. Each tier's login route received a valid Brotli stream of an accepted request, a truncated stream and a corrupted stream, each with and without Content-Encoding: br. Every one was refused with 400 BAD_REQUEST as the bytes it is. Neither tier ever decoded a body, so the header changed nothing.
  • Responses the Gateway fetches. An OpenID Connect provider served its discovery document and its key set as the same three Brotli streams. The Gateway refused each one as an unreadable provider document and never decoded it. With the plain documents the same sign-in steps succeeded.
  • Every process stayed up. After each test both processes were still running and answered their health checks.
  • The shipped server code. No server-side file of the Console and the Gateway loads Node.js's compression module, calls fetch, or loads an HTTP client or middleware that decompresses bodies.

No path in the product decodes Brotli request or response bodies on either Node.js version. The runtime still contains the vulnerable decoder, and the other fixes in the security release apply to every TLS connection the Gateway makes, including the one to your OpenID Connect provider. Upgrade.

The fixed release also changes one answer. A request body that is not valid JSON is refused with 400 BAD_REQUEST. Earlier releases answered such a body with 500 OP_FAILED.

How to check the installed runtime​

On Linux:

/opt/pisoft/tricryption/node/bin/node --version
dpkg-query -W tricryption-node

On Windows, in PowerShell:

& 'C:\Program Files\PiSoft\Tricryption\node\node.exe' --version

For a container image, run the runtime in place of the image's own command:

docker run --rm --entrypoint /opt/pisoft/tricryption/node/bin/node <image> --version

v24.22.2 or later is fixed. v24.18.0 is affected.

What to do​

  1. Verify the new release against its signed SHA256SUMS. See Verifying a release.
  2. Upgrade in the order the Upgrading page gives. On Linux, install the new tricryption-node package together with the new tricryption-console-gateway package. The tier package depends on the exact runtime version. On Windows, install the new tricryption-console-gateway MSI. Container deployments move to the new images.
  3. At code-signing level 2, register the new Console and Gateway release with the key server, as the upgrade page describes.
  4. Check the runtime as shown above.

No configuration setting changes the exposure, and none is needed.