PWA Security Fix Available for CVE-2026-111497

Intershop has fixed a dependency security vulnerability in the Node.js Brotli decoder and recommends that all projects consume this fix in their PWAs as soon as possible (https://github.com/intershop/intershop-pwa/pull/2223). The fix will also be part of the upcoming PWA 13.0.0 release. However, the fix is already available for use.

Updating PWA 8.0.0 – 12.1.0 (Node.js 22)

PWA versions 8.0.0 to 12.1.0 run on Node.js 22. For these versions you don't need to upgrade to Node.js 24. Updating to the patched Node.js 22 release, 22.23.4 or later, is enough. Make the following changes in your project:

1. package.json: update the engines section:

   "engines": {
     "node": "22.23.4",
     "npm": "10.9.9"
   }
   

2. package-lock.json: make the same change to the engines entry of the root package. You can also just run npm install with the new Node.js version.

3. Dockerfile: change both FROM lines (the build stage and the runtime stage):

   FROM node:22.23.4-alpine AS buildstep
   ...
   FROM node:22.23.4-alpine
   

4. .nvmrc: set it to v22.23.4. Also install this Node.js version on local development machines and CI agents.

5. Rebuild and redeploy the PWA SSR image.

Projects that already use Node.js 24 should update to Node.js 24.22.1 in the same files.

Optional: NGINX Brotli Module

The NGINX image isn't affected by CVE-2026-111497. The ngx_brotli module only uses the Brotli encoder for compression, and the vulnerability is in the decoder. To keep the bundled Brotli library up to date (v1.2.1) and avoid findings from security scanners, you can update the NGINX image as well:

• PWA 8.0.0 – 10.1.0: ngx_brotli isn't pinned to a specific version, so you don't need to change the file. Rebuild the NGINX image without the Docker cache (docker build --no-cache ...) so the latest ngx_brotli is used.

• PWA 11.0.0 – 12.1.0: ngx_brotli is pinned to a specific commit in nginx/Dockerfile. Replace that commit:

  && git checkout 53e0fb55f250f48fe80c0ddbf6c0f7103cdbaae1 \
  

PWA on older versions

Intershop recommends to update at least to PWA 8. This is the earliest version which uses Node.js 22.