Node.js Brotli Decoder Out-of-Bounds Write (RCE) – CVE-2026-111497
On October 21, 2026, Node.js shipped security releases across all supported lines fixing a high-severity out-of-bounds write in the bundled Brotli decoder. A Node.js process that decompresses attacker-controlled Brotli data — including Brotli-encoded HTTP responses it fetches — can be driven to write past the end of its buffer, leaking memory or executing code with […] The post Node.js Brotli Decoder Out-of-Bounds Write (RCE) – CVE-2026-111497 appeared first on OX Security .
Continue on OX Security ↗ ‹ All news Get the newsletter
The summary and image come from OX Security; the image is shown from their website.