Brotli flaw in Node.js actively exploited, may allow code execution (CVE-2026-111497)

What happened

A vulnerability tracked as CVE-2026-111497 has been found in Google Brotli, the compression library used to decode Brotli-compressed data. The decoder does not check a return value, which lets a remote, unauthenticated attacker send a crafted Brotli-compressed stream that corrupts adjacent decoder state in memory. Depending on the target, this can disclose sensitive memory contents, cause a denial of service, or potentially lead to arbitrary code execution.

The vulnerability has a CVSS base score of 9.2 and is listed as actively exploited. CISA has added it to its list of vulnerabilities that require mitigation according to vendor instructions. The Node.js project covers it in its October 2026 security releases, where it is described as a Brotli decoder out-of-bounds write that permits remote code execution.

Who is affected

• Servers running Node.js applications that decompress Brotli data, for example from HTTP request bodies, responses fetched from other servers, or uploaded files. Node.js ships its own copy of Brotli, so updating the system library alone does not fix Node.js.
• Systems with the Brotli library installed as a system package. The references for this CVE include a Debian LTS announcement, so distribution packages are affected as well.
• Other software that bundles a Brotli decoder. The references include a .NET announcement, an advisory in the GitHub Advisory Database and a release of the Go port andybalholm/brotli, which indicates that further ecosystems are involved.

The source data does not list exact affected or fixed versions. Check the Node.js security release, the Google Brotli releases and your distribution's advisory linked below for the versions that apply to you.

What to do now

1. Inventory your servers for Node.js installations, including those managed by nvm, containers and hosting panels, and for system Brotli packages.
2. Update Node.js to the patched release for your release line as listed in the Node.js October 2026 security releases. Rebuild and redeploy container images that include Node.js.
3. Update the system Brotli packages through your package manager, for example apt update && apt upgrade on Debian and Ubuntu or dnf upgrade on RHEL-based systems, following your distribution's advisory.
4. Update applications that bundle their own Brotli decoder, such as .NET applications and Go programs using andybalholm/brotli, according to the respective vendor advisories linked below, then rebuild and redeploy them.
5. Restart all affected services: Node.js processes (for example via systemd or your process manager), and any service that loads the system Brotli library, such as web servers with a Brotli module. A running process keeps using the old code until it is restarted.
6. Because the flaw is actively exploited, review logs of internet-facing Node.js services for unexpected crashes or restarts, unusual requests with Brotli-encoded bodies (Content-Encoding: br) and unexpected child processes or outbound connections. If you find signs of compromise, isolate the system and investigate before returning it to service.
7. If you cannot update immediately, consider rejecting Brotli-compressed request bodies at your reverse proxy or in the application until the patch is applied.

How to check whether you are affected

• Show the Node.js version and its bundled Brotli version: node --version and node -p process.versions.brotli. Compare them with the fixed versions in the Node.js security release.
• Check installed system packages: dpkg -l | grep -i brotli on Debian and Ubuntu, or rpm -qa | grep -i brotli on RHEL-based systems, and compare them with your distribution's advisory.
• Find running processes that still use an old, deleted copy of the library after an update: lsof 2>/dev/null | grep -i brotli | grep -i deleted, or use needrestart on Debian and Ubuntu.
• For Go projects, search go.mod files for github.com/andybalholm/brotli; for Node.js projects, check whether dependencies ship their own native Brotli code.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-111497
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog