Fortinet lists Node.js flaws including Brotli decoder RCE
Original title: Multiple Node.js CVEs
One issue, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that permits remote code execution.
Fortinet PSIRT published a notice, scored CVSSv3 9.8, covering multiple Node.js vulnerabilities. CVE-2026-111497 is a Brotli decoder out-of-bounds write that permits remote code execution and affects Node.js 26.x, 24.x, and 22.x. Other listed issues are rated high or medium and affect combinations of those same branches. The feed snippet does not name fixed releases or say whether any flaw is exploited.
Unconfirmed: The snippet is truncated and does not state fixed versions or exploitation status.
- CVE-2026-105483 affects Node.js 26.x and 24.x only.
- High-rated IDs also include CVE-2026-105482 and CVE-2026-106069.
- Medium-rated IDs include CVE-2026-105481, CVE-2026-106072, and CVE-2026-106074.
- The excerpt cuts off at CVE-2026-106070.
Impact: Brotli decoder out-of-bounds write permits remote code execution
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105481 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request | 6.5 | — | ||
CVE-2026-105482+2 related CVEs | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
| CVE-2026-106070 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation… | 3.7 | — | ||
| CVE-2026-106072 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a… | 6.7 | — | ||
| CVE-2026-106074 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into… | 4.8 | — | ||
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
CVSSv3 Score: 9. 8 CVE-2026-105482 - (high)This vulnerability affects Node. js 26.
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.