Retool has rolled out security updates for its self-hosted deployments to address a critical vulnerability in Node.js's native Brotli decoder, but the company's on-premises customers waited nearly 39 hours longer than cloud users to receive the fix. The company released the self-hosted patches on October 23, following a cloud-side repair that went live on October 21, according to timestamps analyzed by TS2.tech.
The flaw, tracked as CVE-2026-111497, affects the Brotli decompression module bundled with Node.js. Attackers can exploit the bug by sending specially crafted compressed data that triggers an invalid block switch, which the decoder mistakenly treats as incomplete input. This allows the decoding process to continue past an eight-byte internal buffer boundary, potentially leading to crashes, memory disclosure, or arbitrary code execution.
Patch Timeline and Deployment Gaps
Retool's disclosure indicates that the cloud patch was deployed 13 hours and six minutes after the vulnerability was publicly disclosed, while the first self-hosted release followed 52 hours and 10 minutes post-disclosure—a gap of 39 hours and four minutes. A subsequent self-hosted update arrived 52 hours and 13 minutes after disclosure, still 39 hours and seven minutes behind the cloud fix.
These timestamps measure the availability of fixes, not the actual installation times for customers. Self-hosted users must manually apply the updates to their own environments, including any bundled container images, which can introduce further delays depending on internal change-management processes.
Scope of Exposure
Not all Node.js applications are vulnerable. The exploit requires that an application decompress attacker-controlled data, which can occur either through an inbound compressed request or via the response from an outbound request to a malicious server. Simply receiving ordinary HTTP traffic does not necessarily expose a service.
Vercel, a major cloud platform, stated in an October 24 bulletin that its firewall blocks the inbound attack vector, but it cautioned that responses fetched from other servers remain outside that coverage. Those applications still require the runtime fix. Vercel also noted that its managed runtimes are being patched, but customers running external backends must upgrade those servers themselves—a firewall rule does not update the Node.js binary running elsewhere.
Node.js and Vendor Responses
Node.js shipped repairs for three supported release lines on October 21: version 22.23.4 for the 22.x line, 24.22.1 for 24.x, and 26.12.1 for 26.x. Applications on older runtimes must be updated to the corresponding fixed version within their deployed environment.
Security researcher Ron Masas of Imperva demonstrated the exploit on an official Node.js 24.22.0 Linux arm64 image on October 22, noting that the proof did not succeed on every attempt and that success was not established across all builds or architectures. The fixed version 24.22.1 rejected the same inputs.
Affected Services and Risk Assessment
Retool identified its MAIN_BACKEND and DB_CONNECTOR services as affected. These services handle resource URLs, authentication endpoints, and custom AI providers, which can supply malicious responses. Exploitation could expose credentials and query data processed by these services. Retool says it has no indications of malicious activity exploiting this flaw against its systems.
Dynatrace (NYSE: DT) announced on October 24 that a patch is available for OneAgent 1.347, but customers with automatic updates disabled must update actively. The company listed Managed, ActiveGate, and Operator components as unaffected. Red Hat rates the issue as Important with a platform-specific CVSS 3.1 score of 8.1, but that rating does not establish the exposure of other vendors' deployments.
Broader Implications
The delay between cloud and self-hosted fixes highlights a common challenge in the software supply chain: even when a vendor patches its own infrastructure, customers running on-premises installations must take action themselves. Firewall protections, as Vercel noted, are not a substitute for runtime updates, especially when traffic originates from external servers.
As of October 25, 2026, no common completion deadline or global count of affected systems has been established. Organizations using Node.js in self-hosted or hybrid environments should prioritize applying the latest patched versions and verify that all deployment paths—including container images and external backends—are updated.
