high severityConfidence highHistorical record

Node.js Brotli decoder writes out of bounds on a malformed stream, reachable through fetch(), Express 5 and zlib (CVE-2026-111497)

Direct answer

Node.js Brotli decoder writes out of bounds on a malformed stream, reachable through fetch(), Express 5 and zlib (CVE-2026-111497), also tracked as CVE-2026-111497 / Node.js Brotli RCE / Node.js Brotli decoder out-of-bounds write is a high-severity threat campaign HOL Guard tracked from Oct 21, 2026 to Oct 22, 2026, verified against 8 primary sources and last reviewed Oct 22, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that Node.js bundles in deps/brotli. The Node.js project rates it high and describes the impact as remote code execution; it affects the 26.x, 24.x and 22.x lines, and end-of-life lines are always affected. Node.js fixed it on 2026-10-21 in 22.23.4, 24.22.1 and 26.12.1 by cherry-picking upstream Brotli commit 0ed4268a ('Detect and report invalid stream earlier'). In the old code, a stream that declared a single block type and then requested a block switch made DecodeBlockTypeAndLength return false, but on the fast decoding path the block-switch wrappers were void functions, so the failure was ignored and decoding continued. The fix returns the new error BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) and stops. Node exposes that constant in zlib.constants, which gives operators a one-line patched/unpatched check. Exposure comes from any code that decodes attacker-influenced Brotli: fetch() (undici) decodes Content-Encoding: br responses, body-parser 2.x (Express 5) decodes br request bodies by default, axios requests br by default, and direct zlib Brotli decompression calls. Brotli itself shipped the fix in 1.2.1, 1.1.1 and 1.0.10 on 2026-10-21.

Also tracked as CVE-2026-111497 · Node.js Brotli RCE · Node.js Brotli decoder out-of-bounds write · Node.js October 2026 security release · Brotli 1.2.1 security fix · BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH

First observed
Oct 21, 2026
Last observed
Oct 22, 2026
Last reviewed
Oct 22, 2026
Tracking ended
Oct 22, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

The CVE record and NVD entry were not public at campaign creation, so there is no CVSS vector or CWE from NVD. Sources differ on demonstrated impact: The Hacker News reports the public proof of concept reached code execution only on a deliberately weakened build, with a crash and limited memory read on a standard build; Vercel's bulletin says researchers demonstrated memory disclosure and command execution on unpatched 22.x, 24.x and 26.x. No exploitation in the wild has been reported and the CVE is not in the CISA KEV catalog as of 2026-10-22.

  • Code that only compresses with Brotli is not the entry point; the patch touches the decoder only
  • Apps that never decode attacker-reachable Brotli are far less exposed
  • Vercel-managed functions on 22.x or 24.x are patched by Vercel; Node 20 projects must change version
  • Browser-side JavaScript uses the browser's Brotli, not Node's
  • Node.js 20 and older are affected and receive no fix
  • Other software bundling its own Brotli decoder needs its own update

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not patch or sit inside the Node.js runtime and does not block malformed Brotli streams; the fix is the Node.js upgrade.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    Google Brotli commits 0ed4268a 'Detect and report invalid stream earlier', adding BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH.

    Sources:nodejs/node 49dff6f57a: deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (CVE-2026-111497)·The Hacker News: Node.js Brotli decoder bug could allow remote code execution

  2. Vendor action

    Node.js releases 22.23.4, 24.22.1 and 26.12.1 fixing CVE-2026-111497 (high) and nine other CVEs.

    Sources:Node.js: Wednesday, October 21, 2026 Security Releases·Node.js 24.22.1 (LTS) release notes

  3. Vendor action

    Brotli ships 1.2.1 (with 1.1.1 and 1.0.10) listing CVE-2026-111497 as a security fix.

    Sources:Brotli 1.2.1 changelog (CVE-2026-111497)·The Hacker News: Node.js Brotli decoder bug could allow remote code execution

  4. Vendor action

    Vercel deploys WAF rules blocking the inbound vector and rolls patched runtimes; fetched responses are not covered by the WAF.

    Source:Vercel: Node.js security advisory, Brotli decoder RCE (CVE-2026-111497)

  5. Disclosure

    The Hacker News reports a public proof of concept that reached code execution only on a deliberately weakened build; standard builds showed a crash and limited memory read.

    Source:The Hacker News: Node.js Brotli decoder bug could allow remote code execution

  6. Update

    HOL publishes the operator write-up with exposure paths, the zlib.constants patch check and scope notes.

    Source:HOL blog: Node.js CVE-2026-111497 operator write-up

Publication clock: 10.0 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Node.js@<22.23.4 || >=24.0.0 <24.22.1 || >=26.0.0 <26.12.1 (all EOL lines affected, no fix)nodejs-runtimepackage
  • google/brotli decoder (bundled as deps/brotli)@<1.0.10 || >=1.1.0 <1.1.1 || >=1.2.0 <1.2.1cremote dependency

Sources

Every claim on this record is traceable to the sources below.

Related reviewed records

Records this one was reviewed against. Every relationship below is part of a released revision, with the reviewer’s stated reason.

Campaign questions, answered

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that js bundles in deps/brotli. HOL Guard tracked the campaign from Oct 21, 2026 to Oct 22, 2026.

No. Active tracking ended Oct 22, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 8 primary sources, names 2 reviewed artifacts, and was last fully reviewed Oct 22, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. The CVE record and NVD entry were not public at campaign creation, so there is no CVSS vector or CWE from NVD.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-D248E742