Node.js Patches High-Severity Brotli Decoder Vulnerability
Node.js has released security updates for CVE-2026-111497, a high-severity memory-safety flaw in its bundled Brotli decompression code. Crafted compressed input can trigger the bug and potentially allow remote code execution. The issue affects the supported 22.x, 24.x, and 26.x branches, and fixes have been issued.
The flaw is an out-of-bounds write in Node.js’s built-in Brotli decompression path. It can be reached when malformed compressed data is processed, and the affected supported release lines are 22.x, 24.x, and 26.x. Patched builds are 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026, alongside fixes for nine other issues.
Brotli is widely used for HTTP content encoding, so exposure is not limited to direct zlib calls. Node.js applications may also invoke the decoder through fetch() when a response declares Content-Encoding: br. Any path that lets attacker-controlled compressed data reach the decoder—such as inbound requests, remote responses, proxy handling, or other processing workflows—could create risk.
Organizations running Node.js services that accept or relay compressed web content could be affected, especially those using Brotli for HTTP responses or proxies. If exploited, the flaw may enable remote code execution or service disruption, potentially exposing data or interrupting availability. Developers and administrators may need to identify affected versions, apply updates, and review data paths where untrusted Brotli input reaches the decoder. The broader impact could extend to users of dependent applications, though actual harm depends on exposure and exploitation.