Node.js CVE-2026-111497

Exploitation requires the target Node.js application to decompress attacker-controlled brotli-compressed data through the bundled brotli decoder - for example handling responses/requests with Content-Encoding: br, or passing untrusted input to zlib.brotliDecompress/BrotliDecompress. The CVSS 4.0 AT:P metric reflects that a specific condition (a malformed brotli stream hitting the BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH error path) must be met rather than the flaw triggering on any input. Limiting factors: deployments that never feed untrusted brotli data to the decoder are not exposed; no authentication (PR:N) or user interaction (UI:N) is required where untrusted brotli is processed. Affected brotli versions are 1.1.0 before 1.1.1, 1.0.3 before 1.0.10, and 1.2.0 before 1.2.1; the complete fix is upgrading to the patched Node.js release v26.12.1 (or a brotli build with the cherry-picked fix) as stated by the vendor. The exact memory-corruption trigger mechanism is not fully described in the available sources.

This is a genuine high priority, not a high-CVSS-but-low-risk issue. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N, score 9.2) describes a network-reachable flaw requiring no privileges (PR:N) and no user interaction (UI:N), with high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H) consistent with the vendor advisory's claim of remote code execution. The one tempering signal is AT:P (attack requirement present), meaning exploitation depends on a specific condition - the application must feed a malformed, attacker-controlled brotli stream through the bundled decoder - rather than being trivially triggerable against any default install. The vuln.today decision label is act_now, reinforcing urgency. Counterbalancing signals: there is NO CISA KEV listing, so this is not confirmed actively exploited, and NO EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be assessed here. A PoC reference is present but is explicitly unverified as working exploit code. Given Node.js's ubiquity and the unauthenticated-network RCE potential, this should be patched urgently even though active in-the-wild exploitation is not confirmed. Note the CWE (CWE-252, unchecked return value) describes the root cause while the advisory describes the consequence as an out-of-bounds write enabling RCE - consistent, but worth verifying the exact impact ceiling with the vendor.

A remote attacker sends crafted, malformed brotli-compressed data to a Node.js application that decompresses untrusted brotli input (for example a service accepting Content-Encoding: br, or code calling zlib.brotliDecompress on user-supplied data). The malformed stream triggers the block-switch error path in the bundled brotli decoder, causing an out-of-bounds write that corrupts memory and, per the vendor advisory, can lead to remote code execution. A public PoC reference exists; it is not verified as working exploit code.