Node.js Brotli Overflow Flaw CVE-2026-111497 Fixes Remote Code Execution

A critical buffer overflow in the Google Brotli decoder allows remote unauthenticated attackers to execute arbitrary code. The National Vulnerability Database rates CVE-2026-111497 as critical with a CVSS score of 9.2. This flaw exists in the c/dec/decode.c component of Brotli versions 1.0.3 through 1.2.0 across all platforms. Attackers can corrupt adjacent memory, disclose sensitive contents, cause denial of service, or run attacker-supplied code using a crafted Brotli-compressed stream.

Root cause

Imperva researchers traced the vulnerability to how the decoder handles an impossible point in a Brotli stream. The stream announces block types it will use as decoding runs. The test input reached a block change that the stream's own structure ruled out. The vulnerable decoder read this invalid state as a request for more input and continued processing, leading to memory corruption.

Attack path

Imperva demonstrated the "Node2Shell" proof of concept on an official Node.js 24.22.0 image for Linux arm64. They achieved code execution without a debugger or custom build by feeding crafted data to the bundled decoder. The test did not succeed on every attempt and required several tries. Code execution was reproduced through both request-body and response paths using Express 5 and body-parser middleware.

Affected versions

Google Brotli versions 1.0.3 through 1.2.0 are affected. This includes any application bundling these versions, such as Node.js lines 22.x, 24.x, and 26.x. Node.js disclosed the flaw and released fixes on 21 October. The fixed release 24.22.1 rejected the same data and prevented code execution.

Mitigation

• Update Brotli libraries or binaries to version 1.0.10, 1.1.1, or 1.2.1.
• Update Node.js to the latest patched version for your specific line.
• Ensure applications decoding untrusted Brotli data are updated immediately.
• Verify that middleware like Express body parsers are updated to safe versions.

Signals worth monitoring

Teams usually check for unexpected process crashes or memory access violations in application logs. Look for anomalous outbound connections from web servers that typically only receive traffic. Monitor for unusual CPU spikes during decompression tasks, which may indicate resource exhaustion. Check whether any scripts are being executed from temporary directories where decompressed data is stored. Review firewall logs for large, unusual payloads sent to endpoints handling compressed data.

Background: CVSS score

A CVE is a unique identifier for a specific security flaw, acting like a name tag. A CVSS score is a numerical rating of that flaw’s severity. You use the CVE to find the issue and the CVSS score to decide how urgently you must fix it. They serve different functions in your workflow.

Read the full guide: Difference Between CVE and CVSS Score: How to Priorise Remediation

What to do and how to stay safe: Google Brotli

• Audit your inventory for any software bundling Brotli versions prior to 1.0.10, 1.1.1, or 1.2.1.
• Priorise updating Node.js applications that process untrusted compressed data via middleware.
• Monitor server logs for crashes or unusual behaviour when processing Brotli-compressed requests.
• Once the vendor provides an update, apply it to all exposed environments immediately.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is CVE-2026-111497 being exploited in the wild?

No exploitation of the flaw in the wild has been reported as of 22 October.

Which Node.js versions are affected by this vulnerability?

Applications on the 22.x, 24.x, and 26.x lines are affected because they bundle vulnerable Brotli decoders.

What versions of Brotli fix this issue?

Users need to update to the latest available versions: 1.0.10, 1.1.1, or 1.2.1.