lee1981 (@lee1981b) on X

What it is

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder (c/dec/decode.c), reported by the Google CNA as "Out-of-Bounds Write in Google Brotli Decoder". Its weaknesses are CWE-787 and CWE-252 (unchecked return value). Google scores it CVSS v4.0 9.2 with the vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Node.js rates it High and gives no numeric score. NVD is still "Awaiting Analysis", and its v4.0 metric is the CNA's, not an independent NIST one. No valid CVSS v3.1 assessment was returned.

How it works

A crafted stream makes the decoder mishandle a block-switch condition and corrupt adjacent decoder state. The upstream fix, authored by Evgenii Kliuchnikov, returns the invalid block-switch status to the caller and stops processing earlier. Possible outcomes are memory disclosure, denial of service or code execution. The post says no universal, reliable RCE is established.

Preconditions / Affected

• Node fixes: 22.x is fixed in 22.23.4, 24.x in 24.22.1 and 26.x in 26.12.1. The post says to migrate EOL lines and not to assume an older line is safe.
• Standalone Brotli: the CNA's structured intervals are 1.0.3 up to but excluding 1.0.10, 1.1.0 up to but excluding 1.1.1, and 1.2.0 up to but excluding 1.2.1. The CNA's prose says 1.0.3 through 1.2.0, so use the structured branches.
• Reachability: attacker-influenced Brotli data must reach the decoder in a real path. Having Node installed, an Accept-Encoding or Content-Encoding: br header, or serving compressed responses does not prove this. Inbound requests, outbound client responses and queued or file input are separate routes.
• Authority: an attacker gets the decoder process's privileges only. Root, SYSTEM and container escape are not automatic.

What to do

• Install the matching Node release, or a distributor build with verified backport evidence.
• Rebuild artifacts and replace the running workers. A new image tag or package file does not replace old containers or already running processes.
• Verify every serving, background, recovery and embedded runtime copy against build identity and process start time.
• Do not trust the bundled version label. The fixed Node 24.22.1 still reports Brotli 1.2.0 because the fix was cherry-picked, so label-only scanners will flag it falsely.
• A lockfile change does not fix Node's bundled decoder. Standalone Brotli needs its own branch fix.
• Before redeploying, preserve existing request or job records, decoder exceptions, worker exits and crash artifacts where practical.
• Join each input or job ID to the decoding component, the worker instance, process lifetime and any crash. Crash dumps can hold secrets, so keep them private.
• Do not feed suspect streams to a decoder to test production or to certify the fix.
• Restricting an unneeded untrusted decoding route is possible, but no vendor-certified workaround was verified. Rate limits, WAF rules and dropping br from advertised encodings do not prove a fix.

Caveats

• Exploitation status: CISA SSVC (22 October 2026, 14:15 UTC) says exploitation none, automatable no, technical impact total. The KEV snapshot (21 October) predates the Node advisory and has no match. EPSS returned no data, which is not a score of zero.
• Lab claims: an author README claims conditional RCE in two Node v24.9.0 Linux x86-64 worker labs and DoS in other fixtures. These were not verified, and no in-the-wild exploitation was confirmed.
• Indicators: there are no CVE-specific IPs, domains, hashes or detection signatures. A crash, a br header or an error code is not a unique indicator. In-process execution may spawn no child process.
• Dates: the CNA's datePublic is 27 February 2026. Brotli 1.2.1 and the Node advisory date from 21 October 2026, and CNA publication was 22 October. These dates do not give a first-attack date.
• Credits: Node credits OpenAI Codex Security (Khai Tran and Sylvie Mayer) for the report, and mcollina and aduh95 for the fix.