Follow Node.js has released security updates addressing CVE-2026-111497, a high-severity vulnerability in its bundled Brotli decompression code that can potentially enable remote code execution. The flaw is an out-of-bounds write triggered when a vulnerable decoder processes specially crafted Brotli-compressed data.
The issue affects all currently supported Node.js branches—22.x, 24.x, and 26.x. Node.js addressed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1 as part of the October 21, 2026 security release, which fixed ten vulnerabilities in total.
The risk is particularly relevant because Brotli compression is commonly used for HTTP traffic. Node.js applications can invoke the vulnerable decoder directly through node:zlib or automatically when fetch() receives a response using Content-Encoding: br. An application may therefore be exposed whenever attacker-controlled Brotli content reaches the decoder through an inbound request, remote response, proxy workflow, or other data-processing path.
For CVE-2026-111497 detection, security teams should prioritize Node.js applications that process untrusted compressed content and monitor them for crashes, abnormal memory behavior, unusual child processes, and suspicious activity immediately following Brotli decompression.
SOC Prime’s AI-Native Detection Intelligence Platform enables security teams to strengthen visibility into emerging vulnerability exploitation and associated post-compromise behavior with detection content deployable across SIEM, EDR, and Data Lake technologies.
Click Explore Detections to access relevant detection content and hunting logic. To Detect CVE-2026-111497, defenders should correlate Node.js application telemetry with endpoint, proxy, web, and network activity to identify suspicious behavior surrounding compressed HTTP traffic.
Security teams can also leverage Prime Architect to transform fresh vulnerability intelligence into Sigma rules and hunting queries, validate detection logic, and translate relevant detection content across supported security platforms.
CVE-2026-111497 analysis
The vulnerability resides in the Brotli decoder bundled with Node.js. Brotli is a compression algorithm widely used to reduce web content size, and Node.js includes its own copy of the library.
A malformed compressed stream can trigger an out-of-bounds write, causing the decoder to write outside the memory buffer allocated for decompressed data. The upstream fix changes the decoder so that invalid input is rejected earlier instead of allowing execution to continue into the unsafe memory-write condition.
CVE-2026-111497 affects Node.js 22.x, 24.x, and 26.x before the October 21 security releases. The patched versions are:
- Node.js 22.23.4
- Node.js 24.22.1
- Node.js 26.12.1
Node.js 20.x and earlier releases have reached end of life and do not receive the security update, so organizations using those versions should migrate to a supported branch.
The underlying problem is not limited to Node.js. The vulnerable code comes from the Brotli project itself, and the corresponding fixes were released in Brotli 1.0.10, 1.1.1, and 1.2.1. Other applications that embed vulnerable Brotli versions may therefore need separate updates even if they do not use Node.js.
The attack surface depends on how compressed data reaches the application. Direct use of Brotli decompression APIs is one obvious route. However, Node.js can also automatically process Brotli-compressed HTTP responses when applications use fetch().
This makes applications that retrieve attacker-controlled content especially relevant. Examples include URL preview services, crawlers, webhook processors, proxy platforms, content scanners, conversion services, and applications that allow users to submit remote URLs.
Inbound traffic can create another path where a web application or middleware accepts Brotli-compressed request bodies. Security teams should therefore examine actual application data flows rather than limiting exposure assessment to explicit Brotli calls in source code.
The details for CVE-2026-111497 show why the issue can have consequences beyond a simple service crash. Memory corruption can potentially affect nearby process state and, depending on platform protections and runtime conditions, lead to memory disclosure or arbitrary code execution.
Node.js explicitly describes the vulnerability as capable of remote code execution, but its practical exploitability deserves nuance. The flaw is rated High by the Node.js Project rather than Critical.
A public CVE-2026-111497 PoC released after disclosure achieved code execution against a deliberately weakened test build. Against a standard Node.js build, the researcher reported a crash and limited process-memory disclosure but did not achieve reliable code execution. This means the memory-corruption primitive is demonstrated, while successful RCE against normal production builds depends on additional exploit conditions.
Patched Node.js versions reject the malformed content used in the demonstration. As of October 22, no exploitation in the wild had been reported.
Accordingly, campaign-specific CVE-2026-111497 IOCs such as malicious IP addresses, domains, payload hashes, or confirmed exploit request signatures have not been published in the cited research.
Security teams should instead focus on behavioral indicators such as:
- Unexpected crashes of Node.js services handling compressed traffic
- Segmentation faults or native decoder failures
- Abnormal memory-protection or exploit-prevention alerts
- Node.js spawning shells or command interpreters
- Unusual outbound connections immediately after Brotli processing
- Suspicious compressed requests from unfamiliar sources
- Server-side fetch() activity reaching untrusted infrastructure
- Unexpected file or process changes originating from a Node.js service account
The October 21 Node.js release also fixed additional high-severity issues involving TLS hostname validation and DNS processing. CybersecurityNews notes that organizations should treat the release as a broader runtime security update rather than focusing exclusively on the Brotli flaw.
The same release also refreshed certificate trust information following the eMudhra certificate authority compromise, further increasing the value of upgrading rather than attempting to backport only one fix.
CVE-2026-111497 Mitigation
The primary CVE-2026-111497 mitigation is to upgrade all supported Node.js installations to a patched version:
- 22.x → 22.23.4 or later
- 24.x → 24.22.1 or later
- 26.x → 26.12.1 or later
The Node.js Project provides no equivalent temporary runtime workaround for the Brotli vulnerability, making upgrading the reliable remediation path.
After updating the runtime, administrators should restart all affected Node.js services. Long-running processes continue using the old runtime until restarted.
Containerized workloads require additional attention. CybersecurityNews specifically recommends rebuilding container images so deployed applications contain the patched Node.js runtime. Updating Node.js on the underlying host does not replace a vulnerable runtime already embedded inside a container image.
Organizations using Brotli independently should also update vulnerable library versions. Software inventories and SBOMs can help identify embedded copies in native applications, appliances, development tools, and third-party packages.
Where immediate upgrading is not possible, organizations can temporarily reduce attack surface by:
- Rejecting Brotli-compressed request bodies where compression is unnecessary
- Restricting server-side HTTP requests to trusted destinations
- Preventing users from supplying arbitrary remote URLs
- Limiting outbound connectivity from vulnerable workloads
- Disabling optional Brotli processing where operationally feasible
- Monitoring application crashes and memory-related errors closely
- Inspecting unusual child processes launched by Node.js
Vercel introduced firewall protections to block malicious Brotli data arriving through inbound requests. However, The Hacker News notes that those rules do not protect applications that independently fetch malicious Brotli responses from external servers, illustrating why WAF filtering cannot replace the runtime upgrade.
Administrators should also confirm the runtime actually used by production workloads after patching. Package-manager output alone is insufficient when older Node.js binaries remain inside containers, serverless bundles, packaged applications, or manually installed runtime directories.
If exploitation is suspected, responders should isolate the affected workload and preserve application, endpoint, proxy, and network telemetry. Crash dumps may be especially valuable because the vulnerability directly affects process memory.
Security teams should investigate:
- Unexpected Node.js child processes
- Newly created files or persistence mechanisms
- Unusual outbound connections
- Changes to application or deployment configuration
- Credentials and secrets available in environment variables
- API keys, tokens, and cloud credentials accessible to the Node.js process
- Backend data stores reachable using the application’s service identity
Because limited process-memory disclosure has been demonstrated, secrets resident in the vulnerable application’s memory should be considered potentially exposed when suspicious exploitation activity is identified, even if arbitrary code execution cannot be conclusively proven.
Organizations should also review the privileges assigned to affected services. Successful exploitation of a minimally privileged container has different consequences from exploitation of a Node.js process holding cloud credentials, database administrative access, CI/CD tokens, or deployment permissions.
SOC Prime customers can leverage behavior-based detection content to identify vulnerability exploitation and related attacker activity while vulnerable systems are discovered and remediated.
Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If relevant detections are not yet available, check again as new threat intelligence and detection content are continuously added.
FAQ
What is CVE-2026-111497 and how does it work?
CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder included with Node.js. A maliciously constructed Brotli stream can cause the decoder to write beyond its intended memory buffer. Depending on the environment and exploitation conditions, this can lead to a process crash, disclosure of process memory, or potentially execution of attacker-controlled code. The vulnerable decoder may be reached through direct decompression APIs or automatically when Node.js processes Brotli-compressed HTTP responses.
When was CVE-2026-111497 first discovered?
The Node.js Project publicly disclosed and patched the vulnerability on October 21, 2026. OpenAI Codex Security researchers Khai Tran and Sylvie Mayer are credited with reporting the issue to Node.js. The Hacker News reports that the corresponding Brotli source-code change was first made upstream in February 2026 but was distributed as a security fix in October.
What is the impact of CVE-2026-111497 on systems?
Successful exploitation can corrupt memory within a vulnerable Node.js process. Possible consequences include denial of service through application crashes, exposure of process memory, and potentially remote code execution. The actual impact depends on whether attacker-controlled Brotli content reaches the decoder and whether the memory-corruption primitive can bypass protections in the target runtime and operating system. If code execution is achieved, the attacker would generally inherit the permissions and access available to the compromised Node.js process, potentially exposing application data, credentials, cloud resources, or connected backend systems.
Can CVE-2026-111497 still affect me in 2026?
Yes. Node.js 22.x, 24.x, and 26.x installations remain vulnerable if they have not been updated to the October 21 patched releases. Organizations running Node.js 20.x or older should migrate to a supported release because end-of-life branches do not receive this fix. Applications that embed vulnerable Brotli libraries independently may also remain exposed even if Node.js itself has been updated.
How can I protect myself from CVE-2026-111497?
Upgrade Node.js to 22.23.4, 24.22.1, 26.12.1, or a newer supported release and restart affected workloads. Rebuild container images, update independently bundled Brotli libraries, and verify that production services are actually running the patched binaries. Until patching is complete, reduce exposure to untrusted Brotli input and restrict server-side requests to approved destinations. Monitor vulnerable services for crashes, unusual child processes, unexpected network activity, and other signs of memory exploitation. If suspicious activity is discovered, isolate the workload, preserve forensic evidence, and rotate sensitive credentials available to the affected Node.js process.
