Node.js Releases Fixes for Brotli Decoder Flaw

Node.js has fixes available for CVE-2026-111497, a Brotli decoder vulnerability classified as high severity in the project’s security advisory. The fixes cover the 22.x, 24.x and 26.x release lines and were published on October 21, 2026. Imperva subsequently published test results showing code execution on one vulnerable Node.js image.

For applications using node:zlib to decompress Brotli data supplied by an attacker, the Node.js advisory describes possible process crashes, disclosure of process memory or remote code execution. It attributes those outcomes to memory corruption caused when malformed input makes the bundled decoder write outside an internal buffer.

The advisory traces the error to the handling of an invalid transition between Brotli blocks. Instead of stopping because the format was invalid, the streaming decoder treated the condition as needing more input. Processing could therefore continue adding bytes to a buffer with a capacity of eight bytes.

Imperva’s October 22 test report identifies the official Node.js 24.22.0 image for Linux arm64 as the environment in which its Red Team obtained code execution. The tests covered two paths: a Brotli-compressed response processed through built-in fetch, and Brotli-compressed request bodies handled by configured parsers. Version 24.22.1 rejected the inputs used in those tests.

Imperva said its setup needed repeated attempts to achieve execution, and its testing did not cover every application or Node.js build. The company identified 22.23.4, 24.22.1 and 26.12.1 as the fixed releases and said users should select those versions, or later fixed versions, within the corresponding release lines.

The affected software extends beyond Node.js, according to Wiz’s advisory summary dated October 25, 2026. Its list includes versions 1.0.3 through 1.2.0 of Google Brotli/libbrotli, excluding patched backports; the same version range for Python Brotli; Bun versions 1.0.21 through 1.4.3; and specified releases of Envoy Proxy and Istio. Wiz lists component-specific patched versions and says additional products may be affected if they include or link to the vulnerable C decoder.

Red Hat assigns the flaw an Important rating and a CVSS v3 score of 8.1 for its products. Its CVE entry states that exploitation depends on a target decompressing Brotli data controlled by an attacker. Red Hat also says its platform hardening makes reliable code execution more difficult.

According to the Node.js advisory, Khai Tran and Sylvie Mayer of OpenAI Codex Security submitted the vulnerability report, while Matteo Collina and Antoine du Hamel made the fix.

* This article is based on publicly available information at the time of writing.