CVE-2026-111497 Brotli Flaw May Enable RCE Across Node.js and Other Software

Summary

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that may allow crashes, memory disclosure or RCE when vulnerable software decompresses attacker-controlled data. Zscaler reports reconnaissance and exploitation attempts.

Key points

The out-of-bounds write affects the Brotli decoder used by Node.js and other software; the article gives the CVSS 4.0 score as 9.2 (Critical).
Exposure depends on whether a vulnerable application decompresses attacker-controlled Brotli data, including through inbound requests or outbound responses.
Imperva reported demonstrating code execution in fresh containers using the official Node.js 24.22.0 Linux arm64 image, requiring multiple attempts in its test environment.
ThreatLabz reports observing reconnaissance and exploitation attempts through Zscaler Deception; the article lists source IPs associated with both activity types.
Organizations are advised to identify vulnerable components and apply vendor updates, including to applications that bundle their own Brotli copy.
Zscaler says its App.Exploit.CVE-2026-111497 signature detects attempts against internal applications accessed through ZPA; it also recommends deploying deception decoys.

Article Details

Vulnerability Types: Out-of-bounds write
Severity: Critical (CVSS 4.0 score 9.2)
Exploitation Status: active
Exploit Availability: unknown
Patch Status: unknown

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]121[.]38[.]163`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`104[.]105[.]82[.]150`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`104[.]234[.]140[.]104`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`104[.]234[.]140[.]110`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`104[.]234[.]140[.]114`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`105[.]213[.]105[.]48`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`136[.]111[.]197[.]96`	Source IP listed as conducting exploitation activity targeting CVE-2026-111497.
IPV4	`15[.]158[.]231[.]107`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`172[.]105[.]229[.]89`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`172[.]105[.]95[.]212`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`172[.]232[.]175[.]104`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`172[.]233[.]109[.]39`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`172[.]235[.]194[.]230`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`188[.]245[.]184[.]87`	Source IP listed as conducting exploitation activity targeting CVE-2026-111497.
IPV4	`213[.]136[.]92[.]88`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`3[.]172[.]4[.]141`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`34[.]10[.]240[.]142`	Source IP listed as conducting exploitation activity targeting CVE-2026-111497.
IPV4	`49[.]36[.]35[.]148`	Source IP listed as conducting reconnaissance for CVE-2026-111497.
IPV4	`49[.]37[.]46[.]99`	Source IP listed as conducting exploitation activity targeting CVE-2026-111497.
IPV4	`52[.]46[.]50[.]66`	Source IP listed as conducting exploitation activity targeting CVE-2026-111497.