cyber.hendryadrian.com
Vulnerability & Exploit · rapid7.com

CVE-2026-111497: Node.js Brotli Flaw Risks Memory Corruption and RCE

· Original article ↗

Summary

CVE-2026-111497 is an out-of-bounds write in Brotli decoders that can corrupt memory and potentially enable RCE when apps decompress attacker-controlled data. Fixed Node.js releases are available; Rapid7 reports no known in-the-wild exploitation as of Oct. 26, 2026.

Key points

  • Malformed Brotli input can trigger an out-of-bounds write in the decoder, corrupting process memory and potentially causing a crash, sensitive-memory disclosure, or remote code execution.
  • Exposure depends on whether an application processes attacker-controlled Brotli data; an affected decoder alone does not establish exposure.
  • Node.js 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1 are affected; upgrade to the respective fixed release or later.
  • The underlying Google Brotli issue may also affect implementations and packages including Bun, Python Brotli packages, .NET, Envoy, Istio, and brotli4j; versions and exposure vary.
  • Rapid7 reported no known in-the-wild exploitation as of October 26, 2026, and said the CVE was not listed in CISA's Known Exploited Vulnerabilities catalog.
  • If an immediate upgrade is not possible, Rapid7 recommends temporarily restricting or disabling application paths that decompress untrusted Brotli data; Node.js has not published a vendor-supported workaround.

Article Details

Vulnerability Types
  • Out-of-bounds write
  • Unchecked return value
Severity
High according to Node.js; Critical, CVSSv4 9.2, according to Google as CNA
Affected Versions
  • Node.js 22.x before 22.23.4
  • Node.js 24.x before 24.22.1
  • Node.js 26.x before 26.12.1
  • Brotli 1.0.3 before 1.0.10
  • Brotli 1.1.0 before 1.1.1
  • Brotli 1.2.0 before 1.2.1
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • If an immediate upgrade is not possible, restrict or disable application paths that decompress untrusted Brotli data as a temporary exposure-reduction measure.

CVE

CVE-2026-111497On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x

Vendors

Googlevulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2.Node.js ProjectOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x

Products

.NETadvisories have also identified affected implementations in Bun, Python's Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages. Affected versions, default exposure, andBrotlithe Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines.brotli4jaffected implementations in Bun, Python's Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages. Affected versions, default exposure, and remediation vary by product;brotlicffiVendor and project advisories have also identified affected implementations in Bun, Python's Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages. Affected versions, defaultBunis not limited to Node.js. Vendor and project advisories have also identified affected implementations in Bun, Python's Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages.Envoyhave also identified affected implementations in Bun, Python's Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages. Affected versions, default exposure, and remediationIstioalso identified affected implementations in Bun, Python's Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages. Affected versions, default exposure, and remediation vary byNode.jsOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.xPython's Brotlito Node.js. Vendor and project advisories have also identified affected implementations in Bun, Python's Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages. Affected

Related Articles