{"type":"bundle","id":"bundle--2024940e-a134-5106-9472-05b3b91c29ff","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--3dc1dc39-19a3-5f02-85bf-6474861109bb","created":"2026-10-22T09:57:35.971Z","modified":"2026-10-22T09:57:35.971Z","name":"Node.js Brotli decoder writes out of bounds on a malformed stream, reachable through fetch(), Express 5 and zlib (CVE-2026-111497)","description":"CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that Node.js bundles in deps/brotli. The Node.js project rates it high and describes the impact as remote code execution; it affects the 26.x, 24.x and 22.x lines, and end-of-life lines are always affected. Node.js fixed it on 2026-10-21 in 22.23.4, 24.22.1 and 26.12.1 by cherry-picking upstream Brotli commit 0ed4268a ('Detect and report invalid stream earlier'). In the old code, a stream that declared a single block type and then requested a block switch made DecodeBlockTypeAndLength return false, but on the fast decoding path the block-switch wrappers were void functions, so the failure was ignored and decoding continued. The fix returns the new error BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) and stops. Node exposes that constant in zlib.constants, which gives operators a one-line patched/unpatched check. Exposure comes from any code that decodes attacker-influenced Brotli: fetch() (undici) decodes Content-Encoding: br responses, body-parser 2.x (Express 5) decodes br request bodies by default, axios requests br by default, and direct zlib Brotli decompression calls. Brotli itself shipped the fix in 1.2.1, 1.1.1 and 1.0.10 on 2026-10-21.","aliases":["CVE-2026-111497","Node.js Brotli RCE","Node.js Brotli decoder out-of-bounds write","Node.js October 2026 security release","Brotli 1.2.1 security fix","BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH"],"first_seen":"2026-10-21T00:00:00Z","last_seen":"2026-10-22T09:51:27Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Node.js: Wednesday, October 21, 2026 Security Releases","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"source_name":"Node.js 24.22.1 (LTS) release notes","url":"https://nodejs.org/en/blog/release/v24.22.1"},{"source_name":"nodejs/node 49dff6f57a: deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (CVE-2026-111497)","url":"https://github.com/nodejs/node/commit/49dff6f57a"},{"source_name":"nodejs/node b5f41529df: src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH","url":"https://github.com/nodejs/node/commit/b5f41529df"},{"source_name":"Brotli 1.2.1 changelog (CVE-2026-111497)","url":"https://github.com/google/brotli/blob/v1.2.1/CHANGELOG.md"},{"source_name":"Vercel: Node.js security advisory, Brotli decoder RCE (CVE-2026-111497)","url":"https://vercel.com/kb/bulletin/node-js-security-advisory"},{"source_name":"The Hacker News: Node.js Brotli decoder bug could allow remote code execution","url":"https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html"},{"source_name":"HOL blog: Node.js CVE-2026-111497 operator write-up","url":"https://hol.org/blog/cve-2026-111497-nodejs-brotli-decoder-out-of-bounds-write"}]}]}