Vulnerabilities · 5h ago

Node.js Brotli flaw reaches code execution on official build

Imperva demonstrated code execution through CVE-2026-111497 in an official Node.js 24.22.0 Linux arm64 build, extending earlier results from a deliberately weakened test build. The test needed several attempts and covered only that setup; Node.js 22.x and 26.x and other architectures were not tested. Node.js released fixes on October 21, and version 24.22.1 rejected the same input. No in-the-wild exploitation had been reported as of October 22.

The malformed Brotli stream reaches a block change that its own structure says cannot occur. Instead of rejecting it, the decoder continues in an invalid state and writes beyond its buffer, corrupting memory and potentially letting crafted input execute code in the Node.js process. Express 5 body parsers can decode Brotli request bodies on routes where they are applied; built-in fetch() handles compressed responses.

For services that pass untrusted Brotli data through those parsers—or consume compressed responses with fetch()—the exposure depends on whether that data reaches the decoder, even if the application expects ordinary JSON. A successful compromise runs with the Node.js process’s privileges; the narrow, intermittent demo establishes possibility, not broad reliability.

CVE-2026-111497

NVD KEV

Timeline

Sources

4 sources covering this story

Entities

Part of the PlainSec briefing for 2026-10-23

Editions

Related stories