RESEARCHERS have demonstrated a remote code execution (RCE) flaw in the Brotli decoder bundled with official Node[.]js builds, by feeding crafted Brotli data that exploits a mismatch in the decoder’s handling of a Brotli stream. The PoC, created by Imperva, ran code on the official Node[.]js 24.22.0 image for Linux arm64, without a debugger or custom build, and leveraged the vulnerability identified as CVE-2026-111497.
The researchers emphasise that exploitation did not succeed on every attempt and that the demonstrated attack worked only in the tested Linux arm64 setup for a single build and application configuration; other architectures and the 22.x and 26.x lines were not tested. When updated to the patched release, 24.22.1, the same data input was rejected and no code executed.
The flaw arises from how the Brotli decoder signals block types during decoding; Imperva’s input triggered a block change that the decoder’s own structure deemed invalid, causing the decoder to continue in an invalid state. Node[.]js addressed the issue by incorporating an upstream Brotli patch that makes the decoder terminate with a format error at that point.
Affected products include Node[.]js 22.x, 24.x, and 26.x lines, including applications that decode untrusted Brotli data via built‑in fetch or through middleware like Express 5’s body parsers (e.g., express[.]json(), express[.]urlencoded(), express[.]text(), express[.]raw()). The advisory notes there is no runtime workaround beyond updating, thoughImperva suggested limiting untrusted Brotli traffic where feasible. Vercel reported it has added protective rules, but these do not replace applying the fix. No in‑the‑wild exploitation had been reported as of 22 October 2026.