Remote Code Execution via Brotli Decoder (CVE‑2026‑111497) Impacts Node.js and Multiple Platforms
A out‑of‑bounds write flaw in Google’s Brotli library (CVE‑2026‑111497) allows remote code execution when attacker‑controlled data is decompressed. The bug affects Node.js and dozens of runtimes that bundle Brotli, exposing any service that processes untrusted Brotli streams. It highlights the need for rigorous dependency‑tracking and patch‑management controls for audit readiness.
ADTP Breach Watch· October 27, 2026· Help Net Security
CVE‑2026‑111497 is an out‑of‑bounds write in the Brotli decoder that can be triggered by supplying crafted Brotli data to the `node:zlib` API. Exploitation can corrupt memory, cause crashes, disclose memory contents, or achieve full remote code execution. The flaw was disclosed by Node.js on 21 Oct 2026, and proof‑of‑concept exploits have been published on GitHub, including successful RCE against the official Node.js 24.22.0 Linux arm64 image. Google fixed the decoder in February 2026 (versions 1.2.1, 1.1.1, 1.0.10) and Node.js released patched runtimes (22.23.4, 24.22.1, 26.12.1). Because Brotli is bundled with many platforms—.NET, Bun, Envoy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse—any application that decompresses attacker‑controlled Brotli data remains at risk until rebuilt with the patched library.
Why it matters for trust and compliance
The vulnerability tests the control objective of secure software supply‑chain and dependency management, a single control that maps to patch‑management requirements across NIST CSF, ISO 27001, and other frameworks.
Demonstrates the need for continuous monitoring of third‑party component versions and timely patch deployment.
Provides concrete evidence for the patch‑management control that auditors expect across multiple frameworks.
Who is affected
TECH_SAASCLOUD_INFRA
Recommended actions
Run an SBOM scan to locate any Brotli‑dependent binaries.
Upgrade Brotli to version 1.2.1 or later and update affected runtimes (Node.js 22.23.4+, 24.22.1+, 26.12.1+).
Rebuild and redeploy container images, then restart services.
Implement continuous monitoring to verify that production workloads run the patched versions.
Document the remediation steps as audit evidence for your patch‑management control.
Details
CVEs
CVE-2026-111497
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.