Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)
Original title: CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.
On October 21, the Node.js Project disclosed CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder on the 22.x, 24.x and 26.x lines. Malformed Brotli input passed to node:zlib can corrupt process memory, causing a crash, memory disclosure or remote code execution. Node.js rates it High; Google, the CNA, assigned CVSSv4 9.2. The bug is in upstream Google Brotli and also affects other implementations. As of October 26, Rapid7 knew of no in-the-wild exploitation.
- Affected Brotli ranges are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1.
- Node.js 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1 are affected.
- Advisories also name Bun, Python Brotli and brotlicffi, .NET, Envoy, Istio and brotli4j.
- No vendor workaround exists; end-of-life Node.js lines should be treated as affected.
- It is classified as CWE-787 and CWE-252.
Impact: Process crash, memory disclosure, or remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| Node.js Project Node.js 22.x | before 22.23.4 | 22.23.4 or later |
| Node.js Project Node.js 24.x | before 24.22.1 | 24.22.1 or later |
| Node.js Project Node.js 26.x | before 26.12.1 | 26.12.1 or later |
| Google Brotli | 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1 | — |
| Bun | — | — |
| Python Brotli | — | — |
| brotlicffi | — | — |
| .NET | — | — |
| Envoy | — | — |
| Istio | — | — |
- 1.Upgrade Node.js 22.x to 22.23.4, 24.x to 24.22.1, and 26.x to 26.12.1 or later.
- 2.If an immediate upgrade is impossible, restrict decompression of untrusted Brotli data.
- 3.Move end-of-life Node.js lines to a supported, fixed release.
- CVEs
- CVE-2026-111497
- Vendors
- Node.js ProjectGoogle
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
3 min read at rapid7.com
Overview On October 21, 2026, the Node. js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node. js.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.