Node.js Brotli Decoder RCE (CVE-2026-111497): Update to 26.12.1, 24.22.1 or 22.23.4

What happened

On October 21, 2026, the Node.js project shipped security releases for the 26.x, 24.x and 22.x lines: 26.12.1, 24.22.1 and 22.23.4. The release fixes 10 CVEs. The Node.js post says the highest severity issue is HIGH.

One of them is CVE-2026-111497, titled "Node.js Brotli decoder out-of-bounds write permits remote code execution." Node.js describes it this way: "A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer."

The cause, in the project's words: "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer." OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it.

Who is at risk

Node.js names one trigger: "An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution."

Node.js lists all of 26.x, 24.x and 22.x as affected and says End-of-Life versions are always affected when a security release occurs. Its post does not name other entry points such as HTTP content-encoding or fetch, so check whether your code or a dependency passes untrusted compressed data into Brotli decompression. Qualys, which published its own analysis on October 23, says HTTP clients and proxies that accept Content-Encoding: br, and services that handle uploaded compressed files, are particularly at risk. That is Qualys's reading, not Node.js's.

The flaw is also upstream. GitHub's advisory GHSA-9v8h-qqgm-4m35 describes a buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli 1.0.3 through 1.2.0 that allows "a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream." The advisory is titled "Node2Shell" and says the PyPI brotli package is also affected.

• Severity: GitHub's advisory and NVD (score supplied by the CNA, Google; NVD analysis still pending as of October 25, 2026) both list CVSS v4.0 9.2 Critical, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The GitHub advisory lists CWE-252 (unchecked return value). NVD lists CWE-252 and CWE-787 (out-of-bounds write). Node.js rates it high and gives no score.
• Brotli library fixes: 1.0.10, 1.1.1 and 1.2.1.
• PyPI: brotli before 1.2.1 and brotlicffi before 1.2.1.0 are affected. Fixed in 1.2.1 and 1.2.1.0.

Is it being exploited?

We found no statement of exploitation in the wild. Neither the Node.js post nor the upstream advisory makes one, and CVE-2026-111497 is not in the CISA KEV catalog version released October 23, 2026. CISA's SSVC assessment attached to the CVE record (October 23, 2026) lists exploitation as "none." That is a point-in-time assessment, not a guarantee, so treat it as "not confirmed," not "safe." The upstream advisory describes the attacker as remote and unauthenticated.

What to do

1. Update Node.js to 26.12.1, 24.22.1 or 22.23.4. Check with node -v on servers, build agents and containers. Node.js has no workaround listed.
2. Update Brotli elsewhere. Python projects should check pip show brotli brotlicffi and move to 1.2.1 or 1.2.1.0. Anything that bundles or links Google Brotli 1.0.3 to 1.2.0 needs 1.0.10, 1.1.1 or 1.2.1.
3. CI and tooling count. Build runners and container images can pin or cache an older Node build. Check the version they actually run with node -v in the job log.
4. Plan the move off unpatched lines. Node.js updated only 26.x, 24.x and 22.x. Qualys lists 25.x, 23.x and 21.x as "No Fix" and 20.x and older as end of life, and says all unpatched lines remain vulnerable. Move to a supported release.
5. If you cannot update today, Qualys's threat research team suggests avoiding Brotli decompression of untrusted input and limiting compressed payload size and decompression ratio at the reverse proxy or WAF. These are Qualys's suggestions, not Node.js's, and Qualys says they "do not make an unpatched runtime safe."

The rest of the release

Three more issues are rated high in the same Node.js release:

• CVE-2026-105482: dns.resolve truncates names containing a NUL character (26.x, 24.x, 22.x).
• CVE-2026-105483: TLS certificate hostname bypass when an IP is written in fullwidth digits (26.x and 24.x).
• CVE-2026-106069: TLS certificate hostname bypass when a leading-zero IPv4 literal such as 0127.0.0.1 is read differently by URL parsing and the OS resolver (26.x, 24.x, 22.x).

The release also updates c-ares, OpenSSL, SQLite and Undici, and the CA certificate store for the eMudhra intermediate CA compromise.

Not checked

We did not check other Brotli consumers (Chromium, Go, nginx, curl, Linux distributions) for advisories. Check your distribution's security tracker.

Sources

• Node.js October 2026 security releases
• GHSA-9v8h-qqgm-4m35 (GitHub Advisory Database)
• google/brotli releases
• Qualys: Node.js Patches Brotli Remote Code Execution Flaw
• CISA Known Exploited Vulnerabilities catalog