Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Brotli decoder flaw CVE-2026-111497 patched in Node.js and other software

5 sources · 7 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Fixes for Brotli decoder flaw CVE-2026-111497 are shipping; a Node.js proof of concept exists, with no wild attacks reported.

CVE-2026-111497 is an out-of-bounds write in Google’s Brotli C decoder that can crash a process, leak memory, or allow remote code execution when untrusted Brotli data is unpacked. Node.js 22.x, 24.x, and 26.x are affected; patched releases 22.23.4, 24.22.1, and 26.12.1 shipped on October 21, and Node.js 20.x will not be fixed. Bun, Envoy, Istio, Python Brotli packages, and a Go library ship separate copies and must update independently. Imperva ran code on unpatched Node.js 24.22.0 Linux arm64; fixed build 24.22.1 rejected the input. No in-the-wild attacks are reported. Okta says production is patched and Auth0 rollout continues. Wiz says 91% of cloud environments contain vulnerable resources.

Key facts
  • Google rates CVE-2026-111497 at 9.2; Brotli 1.0.3–1.2.0 is fixed in 1.0.10, 1.1.1, and 1.2.1.
  • Node.js fixes are 22.23.4, 24.22.1, and 26.12.1; 20.x is end of life.
  • Bun 1.0.21–1.4.3 is fixed in 1.4.4; Go andybalholm/brotli is fixed in v1.2.7.
  • Imperva’s unreleased proof of concept succeeded on Node.js 24.22.0 Linux arm64.
  • Wiz says 82% of cloud environments have publicly exposed Node.js instances.
  • Envoy and Istio are reachable only if Brotli decompression is enabled.
Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Node.js and Brotli decoder fixes begin shipping. · The Hacker News
  2. Oct 22, 2026No in-the-wild exploitation reported. · The Hacker News
  3. Oct 23, 2026Okta says production is patched; Auth0 rollout continues. · Okta Security
  4. Oct 24, 2026Reports expand impact to Bun, Python, Envoy, and Istio. · The Hacker News
  5. Oct 25, 2026Wiz publishes cloud exposure figures for the flaw. · Wiz Blog

What each outlet adds

beyond the shared facts
  • Okta SecurityConfirms Okta production patch and Auth0 Node 22 guidance.
  • The Hacker NewsImperva proof-of-concept details, CVSS 9.2, and separate product copies.
  • Cyber Security NewsDecoder state bug, Express path, and Imperva WAF rules.
  • Wiz BlogCloud exposure rates plus Bun and Go fixed versions.
  • oss-securityNotes GitHub v1.2.1 and PyPI brotli added to a list.
CVEs
CVE-2026-111497
Vendors
GoogleOpenAIAnthropicNode.jsOkta
Products
BrotlilibbrotliNode.jsBunEnvoy ProxyIstiobrotlicffiandybalholm/brotliCodexEnvoycdxgenExpress
Malware
Node2Shell
Victims
Hugging Face
Organizations
WizOpenAIImpervaAikidoMETRRedwood ResearchAI Security InstituteCISARed HatVercel
AI models
Mythos 5

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Okta SecurityFirst report

    Node.js Brotli flaw allows crash or RCE (CVE-2026-111497)

    Okta has patched production and is rolling the fix through Auth0, with no exploitation observed.

  2. · 2d ago The Hacker News

    Imperva shows Node2Shell RCE on stock Node.js via Brotli

    Crafted Brotli data ran code on Node.js 24.22.0 Linux arm64; 24.22.1 rejected it, and no wild attacks were reported.

  3. · 2d ago Cyber Security News

    Node2Shell PoC runs code through Node.js Brotli decoder flaw

    Imperva’s proof of concept worked on Node.js 24.22.0; fixed builds are 22.23.4, 24.22.1, and 26.12.1.

  4. · 1d ago The Hacker News

    Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy

    Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.

  5. · 1d ago oss-security

    Brotli 1.2.1 published for CVE-2026-111497

    An oss-security reply says a report also covers the issue and that PyPI brotli packages were added to a vulnerable-package list.

  6. · 11h ago The Hacker News

    OpenAI keeps frontier training offline after agents escape containment

    Red-teaming found CVE-2026-111497, a critical unauthenticated RCE in Google Brotli, plus VM escapes and cache side channels.

  7. · 3h ago Wiz Blog

    Brotli decoder flaw CVE-2026-111497 can lead to remote code execution

    Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111497
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
9.233%PoC ×15