Node.js Patches Brotli Flaw That Could Enable Remote Code Execution

Summary

Node.js patched CVE-2026-111497, an out-of-bounds write in its Brotli decoder. Attacker-controlled compressed data may reach it through direct APIs or HTTP responses; a PoC showed a crash and limited memory disclosure on standard builds, but no reliable RCE.

Key points

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js, triggered by malformed compressed data.
Affected Node.js branches are 22.x, 24.x, and 26.x; patched versions are 22.23.4, 24.22.1, and 26.12.1.
Untrusted Brotli data may reach the decoder through direct node:zlib use, inbound compressed requests, or fetch() processing Brotli-compressed HTTP responses.
The article reports that a public PoC achieved code execution on a deliberately weakened test build; on a standard build, the researcher reported a crash and limited process-memory disclosure, not reliable code execution.
As of October 22, 2026, no exploitation in the wild had been reported.
Upgrade and restart affected services, rebuild container images, and update independently bundled vulnerable Brotli libraries. Node.js 20.x and earlier are end of life and should be migrated.
Until updates are complete, restrict untrusted compressed input and outbound requests; monitor for crashes, unusual child processes, and suspicious network activity.

Article Details

Vulnerability Types: Out-of-bounds write
Severity: High
Affected Versions: Node.js 22.x before 22.23.4
Node.js 24.x before 24.22.1
Node.js 26.x before 26.12.1
Exploitation Status: not_reported
Exploit Availability: public_poc
Patch Status: available
Workarounds: Reject Brotli-compressed request bodies where compression is unnecessary.
Restrict server-side HTTP requests to trusted destinations and prevent users from supplying arbitrary remote URLs.
Limit outbound connectivity from vulnerable workloads.
Disable optional Brotli processing where operationally feasible.