About:
CVE-2026-111497 is a critical out-of-bounds write vulnerability affecting the Brotli decoder bundled with Node.js versions 22.x, 24.x, and 26.x.
The vulnerability occurs when malformed Brotli-compressed input causes the decoder to write beyond the boundaries of an internal buffer. An attacker who can supply compressed data that an application decompresses using node:zlib may trigger memory corruption, potentially leading to application crashes, process memory disclosure, or remote code execution.
The Node.js project has released fixed versions 22.23.4, 24.22.1, and 26.12.1. No exploitation in the wild has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog. Organizations should update affected Node.js installations, restart applications, and prioritize internet-facing services that process externally supplied Brotli data.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
Identifier: CVE-2026-111497
PoC or Exploitation:
No exploitation in the wild has been reported. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The Node.js advisory does not state that this vulnerability has been exploited.
CVSS Score: Critical
Update / Patch:
Description:
CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js. Malformed compressed input can make the decoder write past the end of an internal buffer.
An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.
Mitigation Recommendation: