Node.js Brotli RCE flaw CVE-2026-111497: patch now
CVE-2026-111497 is a critical Brotli decompression flaw that can let unauthenticated attackers crash a process, expose memory, or potentially execute code when an application decodes malicious compressed data. Node.js has released fixed versions, and no confirmed exploitation has been publicly reported.
What happened?
Confirmed vulnerability: the Node.js project disclosed CVE-2026-111497 on October 21, 2026, describing an out-of-bounds write in the bundled Brotli decoder. If an application decompresses attacker-controlled Brotli data through Node.js, malformed input can corrupt process memory and may cause a crash, disclose memory, or enable remote code execution. The official advisory affects supported Node.js 22.x, 24.x, and 26.x lines. Fixed releases are Node.js 22.23.4, 24.22.1, and 26.12.1. End-of-life Node.js lines did not receive the complete security release and must be moved to a supported version. Independent record: the published CVE assigns the underlying Google Brotli issue a critical 9.2 CVSS v4.0 score and lists affected Brotli releases from 1.0.3 through 1.2.0, with fixed library releases including 1.0.10, 1.1.1, and 1.2.1. Discovery context: Node.js credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer. OpenAI says frontier-model red-team agents found the weakness while testing its own training defenses, then worked with maintainers to remediate open-source issues. Reuters independently reported the disclosure and that Brotli is incorporated into software including Node.js, Bun, and Envoy. Exploitation status: public advisories reviewed for this article do not confirm active exploitation or identify victims. A vulnerable installation is evidence of exposure, not proof of compromise.
How the technology works
At a safe defensive level, Brotli is a compression format used to make web responses, files, and data streams smaller. A decoder should reject malformed compressed input before it touches memory outside the buffer assigned to it. In this flaw, an invalid state can be treated as a temporary request for more input rather than a permanent format error. The streaming decoder can then append bytes beyond a small internal buffer and corrupt neighboring process memory. The practical risk exists when attacker-controlled Brotli content reaches a vulnerable decoder, such as through a service that decompresses uploaded data, processes compressed request bodies, or handles compressed responses from an untrusted source. This is a runtime or bundled-library flaw, so updating ordinary application packages alone may not repair it. This article intentionally omits crafted inputs, proof-of-concept code, memory-corruption techniques, and exploitation instructions.
Who is affected?
Developers and organizations running Node.js 22.x, 24.x, or 26.x below the fixed releases are affected, particularly when services decompress Brotli content from users or remote systems. Vulnerable copies can also remain in containers, base images, developer toolchains, serverless functions, application directories, version-manager folders, embedded runtimes, and single-executable applications. Products that bundle Google Brotli, including some versions of Bun, Envoy, Python packages, operating-system components, or vendor appliances, require their own vendor-specific review and updates; the Node.js version numbers do not apply to those products. Potential consequences include service crashes, exposure of sensitive process memory, and code execution with the permissions of the affected service. There is no public basis to claim that every Node.js server is remotely reachable through this flaw, that every use of Brotli accepts untrusted input, or that customer data has been stolen.
What should you do?
Node.js administrators should inventory every runtime on hosts, containers, build systems, serverless platforms, and developer machines, then upgrade supported lines to 22.23.4, 24.22.1, 26.12.1, or a later release in the same supported line. Replace end-of-life releases rather than waiting for a backport. Rebuild and redeploy container images and single-executable applications, restart services so the new runtime is actually loaded, and verify the serving process version rather than checking only a shell installation. Teams using Bun, Envoy, Brotli libraries, language bindings, or vendor products should follow the matching maintainer advisory and confirm the bundled decoder version. Until updates are complete, reduce exposure of services that decompress untrusted Brotli data and consider temporarily disabling unnecessary Brotli ingestion where that can be done safely; there is no official workaround that replaces upgrading Node.js. Defenders should preserve and review application, proxy, crash, container, endpoint, and identity logs for unexplained decoder errors, process crashes, memory faults, new child processes, changed files, or unusual outbound connections. If compromise is suspected, isolate the service, preserve evidence, rebuild from known-clean sources when appropriate, and rotate secrets reachable by the process. Notify affected people only when verified evidence shows their data was accessed rather than treating the CVE alone as a breach. Software teams should add runtime and base-image versions to asset inventories and software bills of materials so core-library fixes are not missed by package-only dependency scans.
My analysis
My Analysis - opinion and inference: compression code is nearly invisible to most users, but it often handles data before the application gets a chance to validate it. That makes this flaw a reminder that security depends on the runtime and native libraries underneath an app, not only the packages listed in a project file. My inference is that the hardest exposure to remove will be in forgotten containers, embedded runtimes, and end-of-life deployments that ordinary dependency scanners do not flag; that is an operational risk assessment, not evidence those systems have been attacked. From a privacy-first viewpoint, organizations should minimize the personal data and long-lived secrets available to an internet-facing process, isolate services that parse untrusted content, and retain only the security logs necessary to investigate an incident for a defined period. OpenAI's use of agent teams to find the flaw shows real defensive value, but responsible discovery is only useful when maintainers receive time, support, and clear distribution paths for fixes. Companies should report verified compromise promptly, but they should not frighten users by converting a severe vulnerability into an unsupported breach claim.
Why this matters
Cyber incidents often sound distant or overly technical. The important question is whether the same weakness, behavior, surveillance power, or exposure exists in systems you use. Facts and opinion are separated here so you can judge both clearly.
Facts, claims, and unknowns are separated above. Details may change as investigations and official statements develop.
Node.js: October 2026 security releases and CVE-2026-111497 fixes OpenAI: securing the frontier model training environment Reuters: OpenAI discloses the Brotli flaw after its security overhaul GitHub Advisory Database: CVE-2026-111497 Brotli buffer overflow Qualys: finding and patching vulnerable Node.js runtimes