Node.js Brotli Flaw Can Corrupt Memory When Apps Decompress Untrusted Data

Why this Node.js flaw matters

A bug in the Brotli decoder bundled with Node.js can turn malformed compressed data into memory corruption. Applications are exposed when they pass attacker controlled Brotli input to the affected decoder through node:zlib. The Node.js Project says the consequences can include a crash, disclosure of process memory or remote code execution, making the flaw relevant to services that decompress data received from outside their trust boundary.

The issue is tracked as CVE-2026-111497. The Node.js Project published its security advisory on October 21, 2026, and rates the vulnerability High. Google, acting as the CVE Numbering Authority, assigned it a critical CVSSv4 score of 9.2. As of October 26, Rapid7 said it was not aware of exploitation in the wild, and the issue did not appear in CISA's Known Exploited Vulnerabilities catalog. That status doesn’t remove the need to assess systems that process untrusted compressed input.

How the decoder gets into trouble

The underlying defect is in Google Brotli, which the affected Node.js release lines include as a dependency. The decoder mishandles an invalid Brotli block switch: instead of treating it as a permanent format error, it reports that it needs more input. The streaming decoder then continues adding bytes to an internal buffer that is eight bytes long. With malformed input, that process can write beyond the buffer and corrupt memory.

The flaw is categorized as an out-of-bounds write (CWE-787) and an unchecked return value (CWE-252). In practical terms, the decoder’s response to invalid data fails to stop processing when it should. A crash is one possible outcome, but memory disclosure or code execution makes the issue more serious for applications that accept compressed payloads from users or other untrusted sources.

That exposure depends on how a particular service uses Brotli. A deployment that never decompresses attacker supplied Brotli data has a different risk profile from an endpoint that accepts such data and feeds it to the decoder. Teams should trace where compressed input enters their applications, which libraries process it, and whether those paths are reachable by untrusted clients. The presence of the affected dependency alone doesn’t establish that a service is exposed.

Upstream reach extends beyond Node.js

Because the defect originates in Brotli, the Node.js packages aren’t the only implementations to check. The CVE record identifies affected upstream versions on all platforms as Brotli 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. These ranges help identify the upstream component, but downstream projects may package or integrate it differently.

Advisories have also identified affected implementations in Bun, Python’s Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages. Affected versions, exposure by default and remediation differ across products. Check the relevant project or vendor guidance before drawing conclusions from an upstream version range.

Fixed Node.js releases

The Node.js Project has corrected its bundled decoder in the following releases. Versions earlier than the listed release in each supported line are affected:

• Node.js 22.x: upgrade to 22.23.4 or later.

• Node.js 24.x: upgrade to 24.22.1 or later.

• Node.js 26.x: upgrade to 26.12.1 or later.

The project says end-of-life Node.js lines should also be considered affected when a security fix is issued. Teams running an unsupported line should move to a supported line that includes the fix. No vendor-supported workaround has been published. If an upgrade can’t happen immediately, Rapid7 recommends restricting or disabling application paths that decompress untrusted Brotli data to reduce exposure in the meantime.

For current Node.js remediation details, consult the Node.js security advisory. The practical next step is to combine version checks with a review of data flow: confirm whether a service accepts Brotli input, then verify that its runtime or bundled decoder is fixed.

Exposure assessment tools

Rapid7 said Exposure Command, Vulnerability Management and Nexpose customers could expect an authenticated Linux and macOS vulnerability check in the October 26 content release. A Windows check was still in progress at that time, with an update to follow on the Rapid7 blog. These checks can support asset review, while application owners still need to determine whether affected services process untrusted compressed data.