On October 21, 2026, Node.js disclosed a critical vulnerability identified as CVE-2026-111497. This vulnerability is an out-of-bounds write issue in Google's Brotli decoder, which has been assigned a CVSS score of 9.2.
The flaw allows attackers to exploit specially crafted compressed data, potentially leading to remote code execution and memory disclosure. Active exploitation attempts have been reported, particularly targeting Node.js version 24.22.0.
CVE-2026-111497 has been added to the CISA's Known Exploited Vulnerabilities catalog. Multiple security vendors, including Cisco and Palo Alto Networks, have released advisories and patches to address this vulnerability.
The vulnerability affects various software frameworks that utilize the Brotli decoder, including Node.js, Python, and .NET. Zscaler has observed reconnaissance and exploitation attempts targeting this vulnerability through their Deception technology.
The flaw occurs in Brotli’s block-decoding logic, which can lead to an out-of-bounds write and serve as a primitive for remote code execution. Organizations are urged to apply updates immediately to mitigate the risks associated with CVE-2026-111497.