Critical Node.js Brotli decoder flaw CVE-2026-111497 enables RCE

1. Executive summary

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, which Node.js bundles as a dependency and exposes through node:zlib. The flaw carries a CVSS score of 9.2 (CRITICAL) and is not listed in CISA KEV; EPSS puts 30-day exploitation probability at 36%. Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1 are affected, and the same decoder ships in Bun, the Python Brotli and brotlicffi packages, .NET, Envoy, Istio, brotli4j and OS packages, so exposure is not confined to Node.js. Any EMEA financial services application, API gateway, service mesh data plane or CI pipeline that decompresses attacker-supplied Brotli data is a candidate for memory disclosure or remote code execution. No in-the-wild exploitation is confirmed as of 2026-10-26, but a public proof of concept runs code on an unmodified official Node.js 24.22.0 Linux arm64 image, which shortens the window between disclosure and weaponisation.

2. Regulatory framing

3. Technical analysis & attack chain

The decoder mishandles an invalid Brotli block switch. Per the Node.js advisory, it treats the invalid switch as a temporary need for more input rather than a permanent format error. The streaming decoder then keeps appending input bytes to an eight-byte internal buffer, and malformed input writes past the end of that buffer, corrupting adjacent process memory. The CVE record classifies the flaw as both an out-of-bounds write (CWE-787) and an unchecked return value (CWE-252); the GitHub advisory locates the defect in c/dec/decode.c in Google Brotli. The verified record carries CWE-252 and CWE-787, consistent with the vendor's dual classification.

Confirmed attack chain:

1. An application accepts compressed data from an untrusted source and passes it to the affected Brotli decoder. In Node.js this is a call into node:zlib that decompresses attacker-controlled Brotli input.
2. The attacker supplies a crafted Brotli stream containing an invalid block switch.
3. The decoder misreads the invalid switch as a need for more input and continues writing bytes into the eight-byte internal buffer.
4. The write runs past the buffer boundary and corrupts adjacent decoder state memory.
5. Depending on what the corruption reaches, the outcome is a process crash, disclosure of sensitive process memory, or code execution in the process context.

The Imperva proof of concept, reported by The Hacker News, ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64 with no debugger and no custom build, feeding crafted data to the bundled decoder. That establishes exploitability against a stock build, not merely a theoretical corruption. The same reporting says the technique needs no authentication. The proof of concept is single-sourced to Imperva via The Hacker News; no public exploit code, payload or post-exploitation tooling is described in the material reviewed here.

Affected upstream Brotli ranges, per the CVE record, are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1, on all platforms. The GitHub advisory states the affected span as 1.0.3 through 1.2.0 and names the fixed versions 1.0.10, 1.1.1 and 1.2.1, which matches the CVE ranges. Fixed Node.js releases are 22.23.4, 24.22.1 and 26.12.1. Node.js states end-of-life release lines should also be treated as affected when a security release occurs. Downstream products named in the sources as carrying affected implementations are Bun, Python's Brotli and brotlicffi packages, .NET, Envoy, Istio, brotli4j and operating-system packages. Rapid7 notes that the presence of an affected decoder does not by itself establish exposure: the application must pass attacker-controlled Brotli data to it.

Severity is recorded inconsistently across sources. Node.js rates the issue High, while Google, as CNA, assigns CVSSv4 9.2. The verified record carries 9.2 CRITICAL and that is the figure used here. Rapid7 reports no known exploitation in the wild as of 2026-10-26 and the CVE is not in CISA KEV; EPSS stands at 36%. The vulnerability was found with AI tooling, with Node.js crediting Khai Tran and Sylvie Mayer of the OpenAI Codex Security team, per Risky Business News. That detail is single-sourced.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every Node.js runtime at 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1, including container base images, serverless runtimes and build agents. Upgrade to 22.23.4, 24.22.1 or 26.12.1 respectively, outside the normal patch cycle.
• Identify any service that decompresses Brotli input from untrusted clients: HTTP Content-Encoding: br handling, API gateways, proxies and message consumers. Where an immediate upgrade is not possible, restrict or disable those decompression paths, which is the temporary measure Rapid7 recommends in the absence of a vendor workaround.
• Treat end-of-life Node.js lines as affected and plan migration to a supported, fixed line.

P2, within 72 hours:

• Patch the non-Node.js decoders in the estate: Bun, Python Brotli and brotlicffi, .NET, Envoy, Istio, brotli4j and OS Brotli packages, to the fixed upstream versions 1.0.10, 1.1.1 or 1.2.1 as published by each downstream vendor or distribution. Consult each vendor advisory for the exact fixed release, since affected versions and default exposure vary by product.
• Use the Trail of Bits audit tool, released the week before publication per Risky Business News, to check application code for Brotli decompression paths that accept untrusted input. This tool is single-sourced; confirm its provenance before running it in production pipelines.

P3, within 7 days:

• Add a standing check for bundled Brotli versions across dependency manifests and container images, since further downstream fixes are expected over coming months.
• Rapid7 customers can use the authenticated Linux and macOS vulnerability check in the October 26 content release; the Windows check was still in progress at publication.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe a vulnerability and a proof of concept but publish no hashes, network indicators, file paths or command lines tied to exploitation.

6. Detection

Insufficient indicators to author detection rules. The sources give the vulnerable component and the corruption mechanism but no artefacts of an exploit, payload or malicious traffic to build strings from. Detection should instead target the exposure: flag Node.js processes running affected versions and services that accept Brotli-encoded request bodies from untrusted clients, and alert on decoder crashes or abnormal process terminations in those services.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7, "CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder", https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder, 2026-10-26.
• The Hacker News, "Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software", https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html.
• The Hacker News, "Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data", https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html.
• The Hacker News, "Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions", https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html.
• GitHub Security Advisories, "Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package", https://github.com/advisories/GHSA-9v8h-qqgm-4m35.
• Risky Business News, "Risky Bulletin: While everyone was looking at PHP, another RCE is wrecking what's left of the internet", https://news.risky.biz/risky-bulletin-while-everyone-was-looking-at-php-another-rce-is-wrecking-whats-left-of-the-internet/.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-111497 as CVSS 9.2 CRITICAL, not in CISA KEV, with EPSS at 36%. The score reflects a memory-corruption flaw reachable without authentication wherever an application decompresses untrusted Brotli data, and a public proof of concept against a stock Node.js build raises the likelihood of exploitation attempts before a patch cycle completes. Client impact concentrates in internet-facing Node.js services, API gateways and service mesh data planes that accept Brotli-encoded input, and in CI pipelines that build on affected images. No actor attribution is available and none is made; no MITRE ATT&CK profile applies to this item. We will track downstream advisories for Bun, Python, .NET, Envoy, Istio, brotli4j and OS packages as they publish fixed versions, and will reissue this advisory if exploitation in the wild or a CISA KEV listing appears. Clients should confirm their Node.js and downstream Brotli versions against the fixed releases above and report back exposure by 2026-10-29.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.