Open-source package vulnerability · Node.js

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution

high

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that ships inside Node.js. A crafted, malformed Brotli stream can write past a buffer during decompression, and the Node.js team rates it High because it can permit remote code execution. Any Node.js process that decompresses Brotli data an attacker controls is exposed. Update to Node.js 22.23.4, 24.22.1 or 26.12.1.

Published Oct 21, 2026 · Analysis Oct 21, 2026

What an attacker can do

Node.js bundles Google's Brotli library under deps/brotli and exposes it through the zlib module: zlib.createBrotliDecompress(), zlib.brotliDecompress() and zlib.brotliDecompressSync(). The bug sits in the C decoder (deps/brotli/c/dec/decode.c). On some invalid streams the decoder kept going long enough to write outside its buffer. The upstream fix, described as "Detect and report invalid stream earlier," makes the decoder stop and return an error at the first sign of a bad stream; Node.js also exposes the new BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH error code.

The attacker needs a path that feeds their bytes to the decoder. Typical ones:

a server that accepts request bodies with Content-Encoding: br and inflates them
an HTTP client, proxy, crawler or agent tool that fetches attacker-chosen URLs and decodes br responses
code that unpacks uploaded .br files or Brotli-compressed messages from a queue

A memory write in native code runs in the Node.js process, so successful exploitation would give the attacker the privileges of that process and its environment: API keys, cloud credentials and data the service can reach. The advisory gives no exploit details, and no exploitation had been reported.

Who is affected

Every supported line is affected before the fixed release: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. End-of-life lines such as 20.x and 18.x get no fix. The bundled Brotli is used unless you built Node.js against a system Brotli. Check the runtime each service really uses, including containers and Electron apps:

node -v
npx --yes envinfo --binaries 2>/dev/null | grep -i node
docker run --rm <your-image> node -v

To find code that decodes Brotli, search for createBrotliDecompress, brotliDecompress and for HTTP clients configured to accept br encoding.

How to fix it

Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, then restart every Node.js process and rebuild container images, since a running process keeps the old native code. With nvm: nvm install 22.23.4; with Docker, use the matching node:22.23.4, node:24.22.1 or node:26.12.1 tags or later and rebuild with --pull.

The advisory lists no workaround. Until you upgrade, the only way to shrink exposure is to stop decoding untrusted Brotli: drop br from the Accept-Encoding your clients send, and reject Content-Encoding: br request bodies at the proxy.

How to tell if you were hit

Look for Node.js processes that crash with a segmentation fault or abort inside zlib or brotli frames, especially right after handling a compressed request or response. Repeated worker crashes on one endpoint, or a Node.js process that starts spawning shells or making unexpected outbound connections, deserve a closer look. Error logs that show the new BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH code after upgrading mean the fixed decoder rejected a malformed stream. For coding agents and MCP servers built on Node.js, Beam records the shell commands and network tools they launch, which helps spot a process doing things it never did before.

Original advisory

From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.

A flaw in the Brotli decoder bundled with Node.js allows an out-of-bounds write when it decodes a malformed stream, which can permit remote code execution. The fix cherry-picks upstream Brotli commit 0ed4268a, which detects and reports invalid streams earlier. Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, released October 21, 2026.

Credited to mcollina.

Questions

Does CVE-2026-111497 affect fetch() in Node.js?: It affects any path that decodes attacker-supplied Brotli with the bundled decoder. If your HTTP client accepts br responses and decompresses them, fetching an attacker-controlled URL is such a path. The advisory does not list specific APIs, so treat all Brotli decoding of untrusted data as in scope until you upgrade.
Is the Node.js Brotli bug exploited in the wild?: No exploitation had been reported as of October 21, 2026, and the Node.js advisory gives no exploit details. The Node.js team rates it High because an out-of-bounds write in native code can permit remote code execution.
Do I need to rebuild Docker images for this Node.js fix?: Yes. The decoder is part of the Node.js binary inside the image. Rebuild from a fixed base tag such as node:22.23.4 with docker build --pull, redeploy, and confirm with node -v inside the running container.

References

Read for this analysis:

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. The analysis is written by an AI model from the sources listed above and checked by automated rules before it is published. Check versions against the vendor's advisory before you act. Methodology

Coverage on the Beam blog

More Node.js vulnerabilities

All Node.js entries