Node.js

Global – October 29, 2026 -- Node.js issued security releases across all supported lines to fix CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that can lead to remote code execution. A Node.js process that decompresses attacker-controlled Brotli data, including Brotli-encoded HTTP responses it fetches, can be driven to write past the end of its buffer. The result is leaked memory or code execution with the process's privileges.

Ordinary traffic can reach the vulnerable decoder

Node.js bundles Google's Brotli library to back its built-in zlib support. That covers zlib.brotliDecompress(), brotliDecompressSync(), streaming Brotli and transparent decoding of HTTP bodies sent with Content-Encoding: br. Because decompressing untrusted Brotli is common, the bug is reachable across a wide range of services. A web application firewall does not mitigate it.