Node.js Patches Brotli Decoder CVE-2026-111497
First merged summary.
Node.js 22.x 24.x 26.x fixed October 21 for CVE-2026-111497 Brotli OOB write; CISA KEV added October 27 after confirmed exploitation.
On October 21 2026 Node.js released security updates for CVE-2026-111497 an out-of-bounds write in the bundled Google Brotli decoder scored CVSS 9.2. The flaw affects supported lines 22.x 24.x and 26.x and can enable remote code execution in Cisco products using Node.js. Datadog confirmed reproduction on patched builds with a public proof of concept released October 22. CISA added the vulnerability to its Known Exploited catalog on October 27. The issue also impacts Python Bun .NET and WordPress via libcurl unpacking of attacker-supplied brotli responses. Unsupported Node.js versions require migration.
- Node.js fixes 22.23.4 24.22.1 26.12.1 October 21
- CVE-2026-111497 Brotli decoder OOB write CVSS 9.2
- Patched Brotli 1.0.10 1.1.1 1.2.1
- CISA KEV October 27
- Public PoC October 22
- Affects Node.js Python Bun .NET WordPress
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Node.js publishes fixes for CVE-2026-111497 in Brotli decoder for 22.x 24.x 26.x · Node.js
- Oct 22, 2026Public proof of concept for CVE-2026-111497 released · Datadog Security Labs
- Oct 26, 2026Attack using 23M-byte Brotli request from 94.154.43.7 · GBHackers
- Oct 27, 2026CISA adds CVE-2026-111497 to Known Exploited Vulnerabilities · GBHackers
- Oct 28, 2026Cisco Security Advisories on Node.js vulnerabilities · Cisco
- Oct 29, 2026Datadog GBHackers Ubuntu report on CVE-2026-111497 and .NET · Multiple
- Oct 30, 2026Patchstack reports WordPress exposure to CVE-2026-111497 · Patchstack
What each outlet adds
beyond the shared facts- Datadog Security LabsReproduces CVE-2026-111497 and confirms patched Node.js rejects malicious bytes
- GBHackersCISA KEV addition and confirmed exploitation with attack example
- PatchstackWordPress exposure via libcurl unpacking of brotli responses
- UbuntuBrotli CVE-2026-111497 impact in .NET
- CiscoHigh Security Impact Rating for Cisco products using Node.js
Coverage
oldest first · one row per article · UTC- · 4d ago
Cisco Security AdvisoriesFirst report
Cisco warns October 2026 Node.js flaws can enable RCE
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
- · 3d ago
Datadog Security Labs
Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
- · 3d ago
GBHackers
CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
- · 3d ago
Ubuntu Security Notices
Ubuntu fixes .NET debug-proxy and Brotli flaws
The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.
- · 2d ago
Patchstack
Stock WordPress pingback can crash workers via Brotli CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-105482 | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |