Node.js Brotli Decoder Out-of-Bounds Write (RCE) – CVE-2026-111497
Our summary
Node.js maintainers released security updates on October 21, 2026 for all supported release lines to fix a high-severity out-of-bounds write bug in the runtime's bundled Brotli decompression library, tracked as CVE-2026-111497. The flaw lies in how the decoder handles block-type switching: a function meant to signal invalid or incomplete Brotli streams returned an ambiguous boolean that callers — and one caller in particular that ignored the return value entirely — treated as recoverable, letting a malformed block switch push the decoder into invalid state and write past its buffer. Since Node.js uses this decoder for zlib.brotliDecompress()/brotliDecompressSync() and for transparently handling Content-Encoding: br HTTP responses, any application that decompresses attacker-influenced Brotli data or fetches Brotli-encoded responses from untrusted servers is exposed to memory leakage or arbitrary code execution, with no help from a WAF. Affected versions are those before 22.23.4, 24.22.1 and 26.12.1; fixes ship in those exact releases, while unsupported lines such as 25.x, 23.x and 20.x and earlier receive no patch and should be upgraded to a maintained branch. Organizations should prioritize updating and treat any code path that decompresses untrusted Brotli content as high-risk until patched.
Below is the opening; the full story is at OX Security.
From OX Security
On October 21, 2026, Node.js shipped security releases across all supported lines fixing a high-severity out-of-bounds write in the bundled Brotli decoder. A Node.js process that decompresses attacker-controlled Brotli data — including Brotli-encoded HTTP responses it fetches — can be driven to write past the end of its buffer, leaking memory or executing code with the process’s privileges.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.