Out-of-bounds-write

1 post tagged with “Out-of-bounds-write”

BREAKING: Node.js CVE-2026-111497 lets one malformed Brotli body corrupt memory through fetch(), Express 5 and zlib
cvenodejsnode

BREAKING: Node.js CVE-2026-111497 lets one malformed Brotli body corrupt memory through fetch(), Express 5 and zlib

How to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. A malformed Brotli stream makes the bundled decoder write past a buffer, and fetch(), Express 5 body parsing and zlib all reach it.

Oct 22, 2026
Read