The fault in the decoder
The Node.js advisory describes an invalid Brotli block switch being treated as a temporary request for more input instead of a permanent format error. The streaming decoder could then keep appending bytes beyond an internal buffer. The project says a caller that decompresses attacker-controlled Brotli data through node:zlib can suffer memory corruption, a crash, disclosure or remote code execution.
The advisory labels CVE-2026-111497 as high severity. That rating is separate from a report of exploitation in the wild. Neither the advisory nor the supporting research establishes that every service with Node.js accepts attacker-controlled Brotli streams.
Locate reachable deployments
The project lists the 22.x, 24.x and 26.x release lines as affected. The relevant exposure is a decompression call fed by untrusted bytes, which may sit behind an API, a file-processing path or another application layer. Review those paths and their input controls before assigning deployment-specific risk.
The project links security releases v22.23.4, v24.22.1 and v26.12.1. Confirm the exact runtime used by running services and container images after updating. A lockfile or source-code dependency declaration is not proof that a production process has restarted on the corrected binary.
What the evidence does not show
A published proof of concept demonstrates a possible path, but it does not establish active exploitation of a particular organization. If you find suspicious input or crashes, preserve logs and process evidence for a separate incident investigation.
This report focuses on the Node.js bundled decoder. Other products with their own Brotli copies need their own vendor advisories and should not inherit a Node.js fix claim automatically.
Evidence and review
Incident date: Unknown. Evidence checked .
Merged by pankajmouriya · Editorial merge