Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release. All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.

Vercel Developers@vercel_dev3d ago

Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26. Vercel WAF rules are live for every project and block known exploit patterns. https://t.co/JtfEshHnOC