# Heartbeat 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-233)

**URL:** <https://discuss.elastic.co/t/heartbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-233/391370>\
**Category:** Security Announcements\
**Tags:** docker\
**Created:** [November 3, 2026, 4:32pm UTC](https://discuss.elastic.co/t/heartbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-233/391370 "2026-11-03T16:32:21Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Post date:** [November 3, 2026, 4:32pm UTC](https://discuss.elastic.co/t/heartbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-233/391370/1 "2026-11-03T16:32:21Z")

</div>

**Out-of-bounds Write in Heartbeat Leading to Remote Code Execution**

Out-of-bounds Write (CWE-787) in the Brotli decoder of Node.js, a dependency of Heartbeat (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to cause a crash, disclose process memory, or potentially execute code within the Node.js process that runs Synthetics browser monitors via a specially crafted, malformed compressed response. Exploitation requires an attacker who controls an endpoint that a journey requests, or who has compromised an upstream service, to return a response that triggers the known vulnerability CVE-2026-111497. If code execution succeeds, the attacker gains the same access to files, credentials, and network resources as the affected Synthetics process. The Heartbeat Docker image bundles Node.js as the Synthetics monitoring runtime.

**Affected Versions:**

> - 8.x: All versions from 8.0.0 up to and including 8.19.23
> - 9.x:

- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5

**Affected Configurations:**

> - Heartbeat Docker images that run Synthetics browser monitors whose journeys make Node-side HTTP requests, such as requests through the Playwright request API.
> - Exploitation requires the response to be decoded by the Node-side client. Ordinary browser navigation alone does not establish this path.
> - Lightweight monitors (HTTP, TCP, and ICMP) do not use Node.js and are not affected.

**Solutions and Mitigations:**

The issue is resolved in version 8.19.24, 9.4.9, and 9.5.6. The Heartbeat Docker images for these versions bundle Node.js 22.23.4, which contains the upstream fix.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the [known issues](https://www.elastic.co/docs/release-notes) for your target version before upgrading.

**For Users that Cannot Upgrade:**

There are no workarounds for this vulnerability.

**Indicators of Compromise (IOC)**

No specific indicators of compromise have been identified for this vulnerability.

**Severity:** CVSSv3.1: High ( 8.1 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H  
**CVE ID:** CVE-2026-111497  
**Problem Type:** CWE-787 - Out-of-bounds Write