top of page

Node.js Brotli Decoder Out-of-Bounds Write Vulnerability (CVE-2026-111497) Allows Potential Remote Code Execution

October 22nd, 2026

Critical

Our Cyber Threat Intelligence Unit is monitoring CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js, fixed in the October 21, 2026 security release. It affects Node.js 22.x, 24.x, and 26.x, as well as End-of-Life versions that receive no fix. Node.js states it permits remote code execution; exposure requires an application to decompress attacker-controlled Brotli data, such as a request body or a fetched response. The Google CVE Numbering Authority (CNA) scores it CVSS v4.0 9.2 (Critical), while Node.js rates it High. No exploitation in the wild has been reported as of October 22, 2026, and public proof-of-concept code reached code execution only on a deliberately weakened build. Organizations should upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1.

Technical Details

  • Threat Type: Out-of-bounds write (CWE-787) with an unchecked return value (CWE-252) in the bundled Brotli decoder; potential remote code execution

  • Severity: Critical (CVSS v4.0 9.2 per the Google CNA, as listed on NVD; vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Node.js rates it High and publishes no score. NVD has not published a CVSS 3.1 score (status “Received” as of October 22, 2026).

  • Authentication: None required (PR:N); no user interaction (UI:N). Attacker-controlled Brotli data must reach the decoder (AT:P).

  • Threat Actors: None identified.

  • Affected Systems:

    • Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1.

    • End-of-Life versions (20.x and earlier) are affected and receive no fix (Node.js, The Hacker News, Vercel).

    • Upstream Google Brotli 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1.” (CVE record). 

    • Other software that bundles Brotli may need the same update (The Hacker News).

    • Debian’s nodejs package uses the system brotli library. The Debian Security Tracker lists both packages as vulnerable and unfixed in unstable at the time of review.

  • Timeline:

    • February 27, 2026: upstream Brotli commit 0ed4268a (public date in the CVE record).

    • October 21: Node.js and Google release fixes.

    • October 22: CVE record published (13:35 UTC) and NVD entry created (14:17 UTC).

  • Exploit Status: No exploitation in the wild reported; public proof-of-concept code exists.

    • No exploitation in the wild as of October 22 (The Hacker News, HOL). HOL reports the CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog.

    • A public proof of concept reached code execution only on a deliberately weakened, non-PIE test build. On a standard build, its author reported a crash and a limited read of process memory (The Hacker News, PoC README).

    • A second public repository claims remote code execution, but its documented output shows only the decoder continuing past an invalid block switch. Vercel states researchers demonstrated memory disclosure and command execution, so sources differ.

  • Attack Chain:

    • Initial Access: Crafted Brotli data must reach the decoder in a Node.js process that decompresses attacker-controlled data, such as a request body or fetched response. Entry points are node:zlib and fetch() (The Hacker News); HOL also lists body-parser 2.x (Express 5) and axios. Node.js does not decode Brotli on its own (Vercel).

    • Exploitation: A malformed block-switch stream causes an out-of-bounds write. The CVE record states that, on all platforms, a remote unauthenticated attacker can corrupt decoder state memory, disclose memory contents, cause a denial of service, or potentially execute arbitrary code. The upstream fix (commit 0ed4268a) returns a new error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17); Node.js cherry-picked it and exposed the constant (v22.23.4 release notes).

    • Post-Exploitation: Code would run with the permissions of the Node.js process (Vercel). No payload, persistence, or command-and-control activity is documented.

Image by ThisisEngineering

Impact

  • Remote Code Execution: Node.js states the vulnerability permits it, with the permissions of the Node.js process (Vercel). Demonstrated only on a deliberately weakened build (The Hacker News).

  • Memory Disclosure and Denial of Service: Both are listed in the CVE record. The proof-of-concept author reported a limited memory read and a crash on a standard build (The Hacker News).

  • Fetched Content: Vercel states its WAF does not cover responses that functions fetch from other servers; only the runtime patch does.

  • End-of-Life Deployments: Affected and unpatchable (Node.js, The Hacker News, Vercel).

  • Wider Brotli Use: Other software that bundles Brotli may need the same update (The Hacker News).

Detection Method

As of October 22, 2026, none of the sources reviewed publish detection signatures, log indicators or IOCs for this vulnerability.

  • Check patch status with zlib.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, which the fix added (Node.js v22.23.4 release notes). It returns -17 in a fixed build (HOL). Testing confirmed -17 on Node.js 22.23.4, 24.22.1 and 26.12.1, and undefined on 22.22.2, 24.22.0 and 26.12.0 (Linux x64). The check does not cover distro builds that link the system brotli library, which should be verified against distro advisories (Atlas). The process.versions.brotli value does not indicate patch status.

  • Find applications that decompress attacker-controlled Brotli data, directly or through a library (Vercel), including fetch(), zlib, body-parser 2.x and axios (HOL).

  • Vercel states its WAF has rules that detect and block exploitation attempts for traffic through its network, but not for responses functions fetch from other servers.

Indicators of Compromise

No IOCs available.

mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1 (Node.js; HKCERT). Vercel advises upgrading now, regardless of WAF protections.

    • Rebuild container images on a patched Node.js base image and redeploy (Vercel).

    • Vercel-hosted projects: set Node.js to 22.x or 24.x in project settings or engines.node, then redeploy (Vercel).

    • Self-hosted Next.js: upgrade Node.js, as Next.js does not block Brotli responses in image optimization (Vercel).

    • External Node.js backends behind Vercel: restrict direct access so traffic reaches them only through Vercel (Vercel).

  • Move End-of-Life deployments to a supported release line (The Hacker News, Vercel).

  • The Node.js advisory offers no temporary workaround (The Hacker News). WAF protections reduce exposure but do not replace patching (Vercel).

  • Update other software that bundles Brotli to 1.0.10, 1.1.1 or 1.2.1 (CVE record, Google CNA).

Conclusion

CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js 22.x, 24.x and 26.x, and in End-of-Life versions that receive no fix. No exploitation in the wild has been reported as of October 22, 2026, and public proof-of-concept code reached code execution only on a deliberately weakened build. Organizations should upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, move End-of-Life deployments to a supported release line, update other software that bundles Brotli, and verify patch status with the zlib constant rather than the Brotli version string.

bottom of page