As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
CVE-2026-111497 is a critical out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js 22.x, 24.x, and 26.x. The flaw allows an attacker supplying malformed Brotli data to corrupt process memory, potentially leading to denial of service, memory disclosure, or remote code execution (RCE). Node.js has released patched versions (22.23.4, 24.22.1, and 26.12.1) and organizations should upgrade on an urgent basis.
Why it matters: Teams running affected Node.js release lines must prioritize upgrading to patched versions immediately, as the vulnerability enables RCE if applications decompress untrusted Brotli data. The flaw also affects multiple downstream projects including Bun, Python packages, .NET, Envoy, and Istio, so practitioners should check advisories for products in their environment.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
CVE-2026-111497 is a critical out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js 26.x, 24.x, and 22.x, with a CVSSv4 score of 9.2. An attacker supplying malformed Brotli data to an application can corrupt process memory, potentially leading to a crash, memory disclosure, or remote code execution. The vulnerability originates in Google Brotli and also affects implementations in Bun, Python, .NET, Envoy, Istio, and other products; organizations should upgrade Node.js immediately or restrict paths that decompress untrusted Brotli data.
Why it matters: Developers and operations teams running Node.js 22.x, 24.x, or 26.x with applications that process compressed data must upgrade urgently to the patched versions (22.23.4, 24.22.1, or 26.12.1 respectively) to prevent potential remote code execution and memory corruption attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js that carries a CVSSv4 score of 9.2. An attacker supplying malformed Brotli data to a decompression function can corrupt process memory, potentially causing a crash, memory disclosure, or remote code execution. Node.js 22.x, 24.x, and 26.x are affected, with patched versions available as of October 21, 2026.
Why it matters: Organizations running Node.js 22.x (before 22.23.4), 24.x (before 24.22.1), or 26.x (before 26.12.1) that process untrusted Brotli-compressed data face immediate risk of code execution and must upgrade urgently; the vulnerability also affects Bun, Python's Brotli packages, .NET, Envoy, Istio, and operating system distributions, requiring cross-platform assessment.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js, affecting versions 22.x, 24.x, and 26.x, with a CVSS score of 9.2. An attacker supplying malformed Brotli data to an application could corrupt process memory, leading to a crash, memory disclosure, or remote code execution (RCE). The vulnerability also affects upstream Google Brotli and multiple downstream projects including Bun, Python packages, .NET, Envoy, Istio, and operating system distributions.
Why it matters: Organizations running affected Node.js versions 22.x, 24.x, or 26.x should upgrade immediately on an urgent basis outside normal patch cycles to the patched releases (22.23.4, 24.22.1, or 26.12.1) or restrict application paths that decompress untrusted Brotli data, as the vulnerability enables RCE or sensitive memory disclosure.
- Source published
- First seen by Cybersecurity Tracker