Claude Code Brotli Vulnerability: Why Node Updates Aren't Enough
Update the Claude Code executable and any separate Node.js or Bun runtimes, verify the active installation, and audit CI images without mistaking a Claude version number for proof of a patched decoder.
Contents
For the Claude Code Brotli vulnerability alert, update the Claude Code executable you actually run, restart it, and separately patch Node.js or Bun processes used by your other tools. Updating system Node.js does not replace Claude Code’s bundled runtime, including the native executable delivered through current npm installations. As of 2026-10-23, Anthropic’s 2.1.308 release note does not confirm a Brotli fix, so that version number alone is insufficient evidence for a security sign-off.
Why web-fetching agents need attention
The relevant exposure is a process decoding attacker-controlled Brotli data. An agent can encounter that data while retrieving documentation or scraping a website, before the model receives any readable page content.
CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder. The Google-authored CVE record describes possible memory disclosure, denial of service, and arbitrary code execution from a crafted compressed stream. Google assigns the underlying vulnerability a CVSS 4.0 score of 9.2, Critical; the Node.js security advisory classifies its Node.js impact as High.
Bun’s fetch documentation says automatic response decompression is enabled by default and supports Brotli. Consequently, a tool implemented with Bun’s fetch() can reach the decoder when a server returns Content-Encoding: br.
That establishes a reason to audit local fetching tools. Whether a particular Claude Code operation reaches an affected decoder still depends on its implementation and where retrieval runs. A local MCP server, a shell command, and a remotely hosted retrieval service may use different runtimes.
An inbound web application firewall does not cover every such path. Vercel’s advisory explicitly distinguishes incoming requests from responses an application fetches: its WAF protections do not replace patching the runtime that processes those responses.
Which patch versions are confirmed?
The Node.js and Bun patch versions are supported by primary evidence; the proposed Claude Code cutoff requires separate confirmation.
As of 2026-10-23:
| Component | Confirmed patch version | What to update |
|---|---|---|
| Node.js 22.x | 22.23.4 | The Node executable used by that application or tool |
| Node.js 24.x | 24.22.1 | The Node executable used by that application or tool |
| Node.js 26.x | 26.12.1 | The Node executable used by that application or tool |
| Official Bun releases | 1.4.4 | The standalone Bun installation, or the application that embeds it |
| Claude Code | First fixed release not established by the reviewed official evidence | Update the client through its installation channel and retain build-specific verification evidence |
The October 21 Node.js advisory lists all three Node patch releases. Compare versions within the relevant release line: a Node 24 installation needs 24.22.1 or a subsequent patched release, not merely a version numerically above 22.23.4. Node.js 20 no longer receives this fix; Vercel directs those users to a supported release line.
Bun’s fix is traceable beyond a general security announcement. Jarred Sumner’s merged pull request identifies the upgrade to Brotli 1.2.1, and the Bun 1.4.4 release-tag dependency file selects that patched upstream version. The official release was published on October 22.
The Claude-specific claim comes from @ryaneshea’s October 22 post: the author reported finding Bun 1.4.3 in Claude Code 2.1.296 and recommended 2.1.308 or later. That is a community report, not an Anthropic-confirmed mapping.
Anthropic’s 2.1.308 release note says only “Bug fixes and reliability improvements.” Its changelog also lists 2.1.309, but does not supply the missing Bun/Brotli patch mapping for 2.1.308. Update promptly, while keeping “client updated” and “embedded decoder confirmed patched” as distinct findings.
Update the Claude Code installation you actually use
Identify the active installation before changing it. Updating one copy will not help if your terminal, editor, or runner continues launching another.
In Bash, run:
type -a claude
claude --version
claude doctortype -a exposes shell aliases, functions, and matching executable paths. The CLI reference documents claude doctor as a read-only installation and settings diagnostic that does not start a session.
Save your work and exit existing Claude Code sessions before replacing their executable. Choose the update branch that matches your installation.
Native installation
Run this in Bash:
claude updateThe updater follows autoUpdatesChannel and applicable version constraints. An “up to date” result can therefore mean the newest release permitted by your configuration.
For native installations, release-channel settings distinguish latest from the delayed stable channel. Inspect /config → Auto-update channel; a personal setting lives in ~/.claude/settings.json. Centrally managed deployments need their deployed version and policy updated together.
npm installation
Upgrade an npm-managed installation in Bash:
npm install -g @anthropic-ai/claude-code@latestThe current npm setup instructions require Node.js 22 or later for installation and deliver the same native binary as the standalone installer. Use a patched Node release from the table above. The documentation recommends the explicit install command rather than npm update -g, which can retain an older package range.
For Homebrew, use brew upgrade claude-code or brew upgrade claude-code@latest, matching the installed cask. For WinGet, run winget upgrade Anthropic.ClaudeCode in PowerShell. These paths have their own package-manager update behavior.
After the appropriate update finishes, open a fresh terminal. In Bash, verify:
hash -r
command -v claude
claude --version
claude doctorThe version must match the release you intended to install, and the resolved command must correspond to the intended installation. If command -v identifies a function or alias, inspect the earlier type -a output to determine what it launches.
Restart editor-hosted and unattended sessions separately. Checking a newly launched terminal executable does not establish that an older process has been replaced.
If the update fails or the old version remains active
Match the observed symptom to its cause instead of reinstalling everything. Anthropic’s installation troubleshooting guide documents installation conflicts, update failures, and missing npm binaries.
| Symptom | Check and corrective action | Verification |
|---|---|---|
An update completes, but claude --version still reports the old release | Use type -a claude and which -a claude to find competing installations. Correct the launcher or PATH entry that still selects the old copy. | Open a new terminal and check the resolved command and version again. |
A custom ~/.local/bin/claude launcher still starts an old release | Inspect its target. The native updater leaves custom launchers in place, so update the launcher’s selected version as part of deployment. | Check the version through that launcher, not just a newly downloaded binary. |
Error: claude native binary not installed. | Check whether npm omitted optional dependencies or skipped the postinstall script. Restore the required installation steps and reinstall the package. | claude --version runs successfully. |
Auto-update failed · Run claude doctor | Run claude doctor and follow the reported installation or download failure. Use the matching troubleshooting branch. | Run the appropriate updater again, then verify the intended version in a fresh process. |
If the updater reports no newer permitted version, inspect the release channel and centrally imposed ceiling before treating that result as completion. A working installation check establishes that the program starts; it does not test the Brotli vulnerability.
Can you check Claude Code’s bundled Bun version?
The documented Claude commands establish the application version and installation health. The reviewed CLI documentation does not provide a supported command for printing the embedded Bun version.
Running bun --version checks a separate Bun executable on your PATH. Likewise, asking a system Node process for its version describes that Node process. Neither measurement identifies the runtime compiled into Claude Code.
Bun does document BUN_BE_BUN=1 for standalone executables. However, it is not documented as a Claude Code diagnostic, and kk-mats’s Claude Code issue #24575 reports version-dependent behavior. It should not become an assumed reliable security gate for Claude installations.
The published Claude Code 2.1.308 manifest contains release, build, platform, and checksum information, but no Bun component version. Anthropic’s signed-manifest verification procedure can establish that a binary matches the vendor’s release. Establishing the decoder’s patch status additionally requires component or patch evidence tied to that artifact.
For a team security review, record the Claude version, platform, installation source, active executable, and checksum. Seek vendor confirmation for that exact release and platform if the embedded-runtime fix must be certified. Until that evidence is available, record the result as “client updated; embedded-runtime patch status unverified” and pause affected unattended retrieval of untrusted content where your exposure assessment requires it.
Check teammates, containers, and CI runners
Run the inventory inside every execution environment that actually performs agent work. A developer laptop’s results do not describe a container, a self-hosted runner account, or an independently deployed MCP server.
Use this Bash block in an existing fleet-management job or CI step:
set -u
uname -srm
id -un
for tool in claude node bun; do
if executable=$(type -P "$tool"); then
printf '%s\t%s\t' "$tool" "$executable"
"$executable" --version || exit 1
else
printf '%s\tNOT_FOUND\n' "$tool"
fi
doneThe output identifies the operating system, execution user, and PATH executable selected for each tool, followed by its version. NOT_FOUND is an inventory result: a native Claude installation does not require a separate Bun command to exist.
This script deliberately does not print a security “PASS.” Compare Node and standalone Bun results with the confirmed patch versions, and assess Claude’s artifact evidence separately. Bash’s type -P searches executable paths; shell wrappers and executables selected through explicit configuration need their own inspection.
For a team rollout:
- Check the runtime environment. Run the block as the service user, inside the final container or runner environment, after its normal PATH setup. Inspect the executable paths used by MCP servers, SDK hosts, and editor integrations separately.
- Update the build or deployment definition. Replace affected Node/Bun versions and the Claude installation. Rebuild images so an old cached installation layer cannot preserve the previous executable.
- Replace running workloads. Recreate containers and restart runners or services that still execute the old installation. Re-run the inventory in a fresh workload and retain the image digest alongside its results.
- Check one ordinary workflow. Confirm that the updated environment still completes the tool operation your team needs. Record this as a compatibility check, separately from evidence about the decoder patch.
For a standalone Bun installation managed by Bun itself, the release’s documented upgrade command is:
bun upgrade
bun --versionThis updates that Bun installation. An application embedding Bun needs an updated application artifact.
Custom API gateways need client updates too
A custom ANTHROPIC_BASE_URL changes the API destination; it does not replace Claude Code’s local executable. Keep the client current even when requests through your gateway are working.
The official Claude Code changelog documents two separate gateway compatibility fixes:
2.1.305: fixes a2.1.304regression that could make every request fail when Vertex, Bedrock, or another endpoint or gateway rejected tool search, including configurations that disallowedToolSearchor omitted it from--tools. The client now retries without it.2.1.307: stops sending theprompt-caching-scopebeta header behind customANTHROPIC_BASE_URLgateways and on Foundry, where it has no effect.
After updating, repeat the small gateway-backed workflow that previously failed. If it still fails, investigate the endpoint’s response and configuration using the current client; a Brotli update claim does not explain every gateway error. Conversely, a successful gateway request confirms that workflow’s compatibility, while the embedded-runtime patch assessment remains a separate check.
