Table of Contents
On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2.
An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory. According to Node.js, this corruption can lead to a process crash, disclosure of sensitive process memory, or remote code execution. Exposure therefore depends on whether an application passes attacker-controlled compressed data to the affected decoder.
Overview
On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497. The flaw affects the Brotli decoder bundled with Node.js 22.x, 24.x and 26.x.
Node.js rates the issue High. Google, which assigned the CVE, gives it a Critical CVSS v4.0 score of 9.2.
Impact
Malformed Brotli data can cause the decoder to write beyond its allocated buffer, corrupting the application’s memory. According to Node.js, this can crash the process, expose sensitive memory contents or could potentially allow an attacker to run code.
To trigger the flaw, an attacker must get the application to decompress data they control through the affected decoder, exposed in Node.js through node:zlib. Whether a particular service is exposed depends on how it receives and processes compressed data.
Mitigation
Vendors are supplying hotfixes and patches for affected products related to CVE-2026-111497. Organizations running affected node.js products should prioritize patching immediately.
Node.js 22.x releases before 22.23.4 are affected; upgrade to 22.23.4 or later.
Node.js 24.x releases before 24.22.1 are affected; upgrade to 24.22.1 or later.
Node.js 26.x releases before 26.12.1 are affected; upgrade to 26.12.1 or later.
Software Supply Chain
The flaw shows how a single shared component can expose otherwise unrelated applications. Brotli is bundled into libraries across several languages, so its vulnerable decoder can reach software whose developers never chose it directly. It arrives through another dependency.
That creates a chain of responsibility. Brotli’s maintainers fix the decoder; downstream projects incorporate the fix; vendors release updated software; application teams deploy it. Until those changes reach running services, a fix upstream can coexist with vulnerable systems downstream.
For organisations assessing exposure, checking direct dependencies is only the beginning. They also need visibility into what their runtimes, third-party packages and deployed images contain—and whether those components process attacker-controlled data.
