Skip to content

Back to the catalog

orca.securityadvisory

Node.js Brotli Decoder Out-of-Bounds Write Threatens Remote Code Execution Across All Supported Versions

CVE-2026-111497 is a high-severity out-of-bounds write in the Node.js Brotli decoder, reported by Orca Security. It affects all supported release lines (22.x, 24.x, 26.x) and can be triggered by malformed Brotli data processed through node:zlib or fetch(). Impacts named are crashes, memory disclosure and remote code execution in cloud workloads; patching is advised. The fetched text covers only the executive summary.

TL;DR Describes a Brotli decoder out-of-bounds write in Node.js 22.x, 24.x and 26.x that malformed compressed input can turn into remote code execution.
Open original ↗

CVEs named here

Technologies named here

  • Node.js 22.x release line
  • Node.js 24.x release line
  • Node.js 26.x release line
  • node:zlib module
  • fetch in Node.js
  • Cloud workloads running affected Node.js versions
  • Node.js
  • Brotli

Related in AppSec