CVE-2026-111497: Brotli decoder flaw in Node.js and other software
A crafted stream could make the Brotli decoder write past an internal buffer, which can lead to code execution. Node.js fixed it in 26.12.1, 24.22.1 and 22.23.4.
·
What the flaw is
Node.js says the decoder reported an invalid block switch as a temporary need for more input, when it was a permanent format error. The streaming decoder then kept appending input to an eight-byte internal buffer. Node.js says an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory or remote code execution.
Node.js rates the flaw High. Rapid7 says Google, the CVE Numbering Authority, gives it 9.2 on CVSS v4, and NVD shows the same score. Node.js credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting it.
Who is affected
NVD lists Google Brotli 1.0.3 through 1.2.0, with fixes in 1.0.10, 1.1.1 and 1.2.1. Node.js 26.x, 24.x and 22.x bundle the decoder.
Rapid7 says advisories also name Bun, the Python Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j and operating-system packages. It says an affected decoder does not by itself mean exposure, unless an application processes attacker-controlled Brotli data.
What to do
Upgrade Node.js to 26.12.1, 24.22.1, 22.23.4 or later. Rapid7 says Node.js treats end-of-life release lines as affected, and that those users should move to a supported line. Check the vendor advisories for other software that bundles Brotli.
Rapid7 says Node.js has published no supported workaround. If you cannot upgrade at once, Rapid7 suggests restricting or disabling application paths that decompress untrusted Brotli data.
Exploitation so far
CISA added the CVE to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a 10 November deadline for US federal civilian agencies, and lists ransomware use as unknown. CISA's entry and Rapid7's post give no details of the attacks.
Official records
Further reading
- Rapid7 ↗: A summary covering fixed versions and affected software beyond Node.js.