diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..ce62013
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.22.1
diff --git a/backend/.nvmrc b/backend/.nvmrc
new file mode 100644
index 0000000..ce62013
--- /dev/null
+++ b/backend/.nvmrc
@@ -0,0 +1 @@
+24.22.1
diff --git a/backend/app.js b/backend/app.js
index 9b360b9..a1a58f6 100755
--- a/backend/app.js
+++ b/backend/app.js
@@ -1,3 +1,4 @@
+import './scripts/require-safe-node.cjs';
 import express from 'express';
 import path from 'path';
 import { fileURLToPath } from 'url';
diff --git a/backend/daemonServer.js b/backend/daemonServer.js
index bd62807..0c9fe26 100755
--- a/backend/daemonServer.js
+++ b/backend/daemonServer.js
@@ -1,3 +1,4 @@
+import './scripts/require-safe-node.cjs';
 import WebSocket, { WebSocketServer } from 'ws';
 import https from 'https';
 import fs from 'fs';
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 304b502..3936c23 100755
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "backend",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "backend",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "license": "ISC",
       "dependencies": {
         "@gltf-transform/cli": "^4.3.0",
@@ -38,6 +38,9 @@
       },
       "devDependencies": {
         "sequelize-cli": "^6.6.5"
+      },
+      "engines": {
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
       }
     },
     "node_modules/@asamuzakjp/css-color": {
diff --git a/backend/package.json b/backend/package.json
index db9e24b..9662557 100755
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "backend",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Nach Änderungen an dependencies: npm install ausführen und package-lock.json committen (npm ci im Deploy).",
   "type": "module",
   "main": "index.js",
@@ -58,5 +58,8 @@
     "sequelize": {
       "uuid": "14.0.0"
     }
+  },
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   }
 }
diff --git a/backend/scripts/require-safe-node.cjs b/backend/scripts/require-safe-node.cjs
new file mode 100644
index 0000000..b5c7311
--- /dev/null
+++ b/backend/scripts/require-safe-node.cjs
@@ -0,0 +1,22 @@
+// CVE-2026-111497: Node's bundled Brotli decoder must include the security fix.
+// Check Node versions: patched releases can still report Brotli 1.2.0.
+// https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
+'use strict';
+
+function requireSafeNode() {
+  const [major, minor, patch] = process.versions.node.split('.').map(Number);
+  const minimum = { 22: [23, 4], 24: [22, 1], 26: [12, 1] }[major];
+  const patched = minimum && (minor > minimum[0] ||
+    (minor === minimum[0] && patch >= minimum[1]));
+
+  if (!patched) {
+    throw new Error(
+      `CVE-2026-111497: Node.js ${process.versions.node} is not an approved patched runtime. ` +
+      'Use Node.js 22.23.4+, 24.22.1+ or 26.12.1+ within those release lines. ' +
+      'Recommended: nvm install && nvm use (see .nvmrc). Restart all server/PM2 processes after upgrading.'
+    );
+  }
+}
+
+requireSafeNode();
+module.exports = requireSafeNode;
diff --git a/backend/server.js b/backend/server.js
index 22b53e4..1eff045 100755
--- a/backend/server.js
+++ b/backend/server.js
@@ -1,3 +1,4 @@
+import './scripts/require-safe-node.cjs';
 import './config/loadEnv.js'; // .env deterministisch laden
 
 import http from 'http';
diff --git a/package-lock.json b/package-lock.json
index 3dea2e0..7f5d81d 100755
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "yourpart",
-    "version": "3.0.0-beta-1.0.0",
+    "version": "3.0.1-beta-1.0.0",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "yourpart",
-            "version": "3.0.0-beta-1.0.0",
+            "version": "3.0.1-beta-1.0.0",
             "dependencies": {
                 "cors": "^2.8.6",
                 "dompurify": "^3.3.3",
@@ -16,6 +16,9 @@
                 "concurrently": "^9.2.1",
                 "nodemon": "^3.1.14",
                 "npm-run-all2": "^8.0.4"
+            },
+            "engines": {
+                "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
             }
         },
         "node_modules/@isaacs/cliui": {
diff --git a/package.json b/package.json
index 78cc46d..5b3ee87 100755
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "yourpart",
-    "version": "3.0.0-beta-1.0.0",
+    "version": "3.0.1-beta-1.0.0",
     "scripts": {
         "start": "npm-run-all --parallel build start:backend",
         "build": "cd frontend && npm run optimize-models && npm run build",
@@ -21,5 +21,8 @@
     },
     "overrides": {
         "minimatch": "10.2.4"
+    },
+    "engines": {
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
     }
 }