diff --git a/.nvmrc b/.nvmrc
index 2bd5a0a..ce62013 100755
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22
+24.22.1
diff --git a/nuxt.config.js b/nuxt.config.js
index 925f811..03eb1e5 100755
--- a/nuxt.config.js
+++ b/nuxt.config.js
@@ -1,3 +1,4 @@
+import './scripts/require-safe-node.cjs';
 // https://nuxt.com/docs/api/configuration/nuxt-config
 export default defineNuxtConfig({
   devtools: { enabled: process.env.NODE_ENV !== 'production' },
diff --git a/package-lock.json b/package-lock.json
index 2a73eb6..ffc18d9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "harheimertc-website",
-  "version": "1.8.13",
+  "version": "1.9.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "harheimertc-website",
-      "version": "1.8.13",
+      "version": "1.9.1",
       "hasInstallScript": true,
       "dependencies": {
         "@pinia/nuxt": "^0.11.2",
@@ -44,7 +44,7 @@
         "vue-eslint-parser": "^10.2.0"
       },
       "engines": {
-        "node": ">=22.12.0",
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1",
         "npm": "10.9.7"
       }
     },
diff --git a/package.json b/package.json
index 7cf38d3..b6e925c 100755
--- a/package.json
+++ b/package.json
@@ -1,11 +1,11 @@
 {
   "name": "harheimertc-website",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Moderne Webseite für den Harheimer Tischtennis Club",
   "private": true,
   "type": "module",
   "engines": {
-    "node": ">=22.12.0",
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1",
     "npm": "10.9.7"
   },
   "scripts": {
diff --git a/scripts/require-safe-node.cjs b/scripts/require-safe-node.cjs
new file mode 100644
index 0000000..b5c7311
--- /dev/null
+++ b/scripts/require-safe-node.cjs
@@ -0,0 +1,22 @@
+// CVE-2026-111497: Node's bundled Brotli decoder must include the security fix.
+// Check Node versions: patched releases can still report Brotli 1.2.0.
+// https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
+'use strict';
+
+function requireSafeNode() {
+  const [major, minor, patch] = process.versions.node.split('.').map(Number);
+  const minimum = { 22: [23, 4], 24: [22, 1], 26: [12, 1] }[major];
+  const patched = minimum && (minor > minimum[0] ||
+    (minor === minimum[0] && patch >= minimum[1]));
+
+  if (!patched) {
+    throw new Error(
+      `CVE-2026-111497: Node.js ${process.versions.node} is not an approved patched runtime. ` +
+      'Use Node.js 22.23.4+, 24.22.1+ or 26.12.1+ within those release lines. ' +
+      'Recommended: nvm install && nvm use (see .nvmrc). Restart all server/PM2 processes after upgrading.'
+    );
+  }
+}
+
+requireSafeNode();
+module.exports = requireSafeNode;
diff --git a/server/plugins/require-safe-node.js b/server/plugins/require-safe-node.js
new file mode 100644
index 0000000..85eef7c
--- /dev/null
+++ b/server/plugins/require-safe-node.js
@@ -0,0 +1,6 @@
+import requireSafeNode from '../../scripts/require-safe-node.cjs';
+
+// An explicit call keeps the guard in Nitro's production bundle.
+requireSafeNode();
+
+export default defineNitroPlugin(() => {});