Covered by 2 outlets — first reported by Rapid7 Blog, Oct 26, 17:32 UTC
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
MentionsGoogle
In brief
Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x , 24.x , and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2 .
From Rapid7 Blog's coverage.
Continue reading
2 outlets, in the order they reported it.
Rapid7 BlogFirst report
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js.
Datadog Security Labs
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.
Explained
The technology and terms in this story. Learn more
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.