Node.js Brotli flaw could expose memory or enable remote code execution

CVE-2026-111497 is a critical out-of-bounds write vulnerability affecting the Brotli decoder bundled with Node.js, disclosed by the Node.js Project on 21 October 2026. Rapid7 notes that the issue allows memory corruption when an application decompresses attacker-supplied Brotli data via node:zlib, with potential outcomes including a process crash, disclosure of sensitive process memory, or remote code execution. Exposure depends on whether an affected application processes untrusted Brotli data.

The vulnerability originates in Google Brotli and affects upstream Brotli ranges used by Node.js’ bundled decoder, with impacted upstream versions listed as 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. The Node.js advisory, cited by the Node.js Project, confirms the potential for remote code execution if attacker-controlled data is decompressed.

Mitigation guidance from Rapid7 and the Node.js advisory directs upgrading to fixed releases: Node.js 22.x before 22.23.4, Node.js 24.x before 24.22.1, and Node.js 26.x before 26.12.1. Organisations running end-of-life Node.js releases should migrate to supported fixed lines; there is no vendor-provided workaround available, and a temporary measure is to restrict or disable paths that decompress untrusted Brotli data where immediate upgrading isn’t possible.

Rapid7 notes that, as of 26 October 2026, there was no known in-the-wild exploitation and no listing in CISA’s Known Exploited Vulnerabilities catalog, but emphasises prioritised remediation due to the potential for memory disclosure and RCE. The advisory also mentions related implementations in Bun, Python Brotli packages, .NET, Envoy, Istio, Brotli4j, and various OS packages, urging consultation of downstream advisories to assess exposure.