Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js Brotli decoder out-of-bounds write flaw allows RCE in all supported versions
Run Google?
Get an email when a reviewed story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Node.js released security patches on October 21 for versions 22.x, 24.x, and 26.x addressing 10 vulnerabilities, with the critical issue being an out-of-bounds write in the bundled Brotli decompression library (CVE-2026-111497) that could enable remote code execution. The flaw affects any application decompressing Brotli data from untrusted sources, including automatic decompression via fetch() calls. While the project rates it high severity and describes RCE potential, a public proof-of-concept demonstrated only crashes and limited memory reads on standard builds, with no wild exploitation reported as of October 22.
The lesson from this incident
Full lessonAn out-of-bounds write vulnerability in Node.js's bundled Brotli decompression library (CVE-2026-111497) exposes all supported Node.js versions to potential remote code execution when handling untrusted compressed data, including via automatic fetch() decompression. The root issue is that a third-party library embedded directly within the Node.js runtime was not patched promptly, meaning every application built on the platform inherited the flaw without any individual developer action. This matters because developers often assume the runtime itself is secure, creating a blind spot for vulnerabilities residing in bundled dependencies. The broad attack surface — any app decompressing Brotli from external sources — means the exposure is widespread across the Node.js ecosystem.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-111497
- cve — CVE-2026-106069
- cve — CVE-2026-105483
- cve — CVE-2026-105482
- cve — CVE-2026-105481
- cve — CVE-2026-106072
- cve — CVE-2026-106074