Quick answer: CVE-2026-111497 is a high severity out of bounds write vulnerability in the Brotli decoder inside the Node.js runtime, and it can lead to remote code execution (RCE). A crafted Brotli compressed input can cause the decoder to write past the buffer it allocated, and the resulting memory corruption may, depending on conditions, turn into code execution. Because the flaw lives in the runtime itself, it cannot be switched off with configuration. The only durable fix is upgrading to a patched version: v22.23.4, v24.22.1 or v26.12.1. End of life (EOL) lines are affected too but receive no patch.

The Node.js team flagged this Brotli decoder flaw as high priority in its security release dated 21 October 2026. That release carried ten fixes in total, yet CVE-2026-111497 deserves its own attention because its attack surface is unusually wide. The reason is simple: Brotli compression is everywhere in the modern web stack, and it often kicks in through paths the developer never explicitly chose. This article explains what the flaw is, why memory corruption can mean RCE, which doors untrusted Brotli data uses to reach an application, and what you should do about it.

What an out of bounds write is and why it is so dangerous

An out of bounds write happens when a program writes data past the boundaries of the memory block it allocated. When a decoder expands incoming compressed data, it calculates how much space the output will need and allocates a buffer accordingly. If that calculation can be misled by attacker controlled input, the decoder tries to write more than it reserved and spills over into neighboring memory regions. MITRE classifies this weakness as CWE-787 (out of bounds write) and treats it as one of the most dangerous families of memory safety bugs.

The danger lies in where those spilled bytes land. If neighboring memory holds a function pointer, a length field, or a return address on the stack, an attacker who can write controlled values over them may try to redirect the program's flow in their favor. This is exactly the point where a memory corruption bug evolves into remote code execution potential. We covered how this class of memory safety issues differs from command level injection in our article on what command injection is and how to defend against it.

To be honest: the advisory did not publish a definitive exploit chain or public proof of concept for this flaw. RCE here is a potential, not a certainty. Reaching code execution in the real world depends on compiler mitigations, memory layout, and the exact path the input triggers. Even so, the high severity rating and the broad attack surface make this flaw far too serious to leave to guesswork.

Where Brotli enters Node applications

Brotli is a modern compression algorithm designed for HTTP, and it ships built into Node.js through the zlib module. Most developers never think they call it directly, yet many indirect paths trigger the decoder automatically. The crucial point is this: to exploit this flaw, all an attacker needs to do is deliver a crafted Brotli stream that the application will decompress somewhere.

The table below summarizes where untrusted Brotli input typically meets a Node application.

Attack surface How Brotli enters Who controls the input
Outbound fetch and undici requests A remote server sets br encoding in its response, Node decompresses automatically The remote server you connect to, or a man in the middle
Compressed request bodies from clients If the app decompresses request bodies by their content encoding Any client sending a request
File or document uploads If uploaded content is Brotli packed and expanded on the server The user performing the upload
Proxy, middleware or microservice traffic If an internal service decompresses an incoming response Any untrusted endpoint in the chain

The most frequently overlooked scenario is outbound requests. If your application talks to an external API using fetch or undici and the other side compresses its response with br, Node expands that response without you doing anything. If the other side is compromised or malicious, the crafted response flows straight into the vulnerable decoder. The same holds for an attacker in a man in the middle position. In short, the risk is not limited to externally exposed services, every Node process that makes outbound requests is also a target.

How an attacker delivers untrusted Brotli input

The logic of the attack is direct: pass attacker crafted bytes to the vulnerable decoder. If an exposed endpoint accepts compressed request bodies, the attacker prepares the body themselves and declares the content encoding as br. If your application pulls content from external sources, the attacker manipulates the response from a server or network position they control. In an upload flow, the file arrives Brotli packed and the flaw triggers as the server expands it.

That variety makes it impossible to deflect the flaw with a single configuration switch. The triggering data travels through the application's normal execution path and needs no exotic plugin or rare module. We argued in our article on verified vulnerability testing without false positives that a security test must demonstrate such paths with real evidence rather than speculation, because version matching alone does not always imply exploitability.

Impact and what to do

The affected lines and patched versions are in the table below. This flaw concerns the 26.x, 24.x and 22.x branches, as well as older lines that are no longer supported.

Node.js line Status Patched version
26.x (Current) Affected v26.12.1
24.x (LTS Krypton) Affected v24.22.1
22.x (LTS Jod) Affected v22.23.4
20.x, 18.x and earlier (EOL) Affected No patch, migration required

What to do is clear: check your version and upgrade. Run node -v, and if the version shown is older than the patched release, update immediately. If you use containers, rebuild with an up to date base image, because a team level update does not change a running production image. Since the flaw lives in the runtime, it cannot be closed with an environment variable or a setting. Even disabling Brotli use entirely is not a reliable defense, because controlling the automatic decompression behavior on outbound requests is not something you can depend on.

If you are still on an end of life Node.js line, the situation is worse: you are affected, but an official patch will never arrive. This shows why running an EOL runtime is a risk in itself, a topic we examined in depth in our article on EOL runtime risk and end of life migration. For the full list of the other nine fixes in this release and their priority order, see our Node.js October 2026 security update patch guide. For the sibling critical RCE that hit the PHP core on the same day, see our PHP2Shell CVE-2026-109618 and 109619 analysis. For teams that want to handle releases like this systematically, our patch management and update guide offers a framework.

The KAOS and DSET approach

When DSET scans for flaws like this, it first detects the runtime version of every Node.js process in the asset inventory. KAOS, DSET's local artificial intelligence engine, maps the detected version to known CVE databases, then prioritizes by cross referencing exploited vulnerability lists such as the CISA KEV catalog. For a finding like CVE-2026-111497, KAOS does not merely report that a version number matches, it narrows the attack surface by checking whether the application actually enters a Brotli decompression path, meaning outbound fetch usage, acceptance of compressed requests, or upload flows.

Here, honesty comes before marketing for us. A version match is a hypothesis, not a confirmation. A backport may be in place, a mitigation may be active, or the triggering path may simply not exist in the application. The KAOS over claim brake does not report an exploit it cannot demonstrate with evidence as confirmed, it instead keeps the finding at the level of affected, active verification required. Definitive confirmation requires active verification in a controlled and authorized environment. This approach lets you focus on real risk without false positives stealing your team's time.

Frequently asked questions

I do not think I use Brotli, am I still affected? You most likely use it without noticing. The fetch and undici clients shipped with Node.js automatically expand content when remote servers reply with br encoding. Any process that talks to an external API, scrapes the web, or receives webhooks potentially passes through the vulnerable decoder. So the fact that you do not actively call Brotli does not keep you safe. What matters is whether your application ever encounters an untrusted Brotli stream.

Can I close the flaw with a configuration instead of patching? No, not reliably. The flaw lives in the decoder inside the runtime itself, not in an application setting or an environment variable. Reducing Brotli use in your code can narrow the attack surface, but it does not fully close indirect paths such as automatic decompression on outbound requests. The only durable and reliable fix is upgrading to a patched Node.js version.

Did the advisory show a definitive exploit, is this flaw being actively exploited? The advisory described the flaw as a high severity out of bounds write and noted RCE potential, but it did not share exact exploitation conditions or a public proof of concept. Official confirmation of widespread active exploitation is limited at the time of release. Even so, the high severity, the broad attack surface, and the tendency of memory corruption flaws to be weaponized over time justify urgent patching. The safest course is to close the risk without waiting for an attacker to publish a proof of concept.

Sources

To verify this flaw in your Node.js infrastructure, prioritize it, and build a safe upgrade plan, contact DSET. Our team is based at Ankara Hacettepe Teknokent and provides enterprise teams with evidence based vulnerability verification and patch management support.