CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

T1High 40Covered by 1 source · first reported by Rapid7 at 26 Oct, 17:32 UTC

Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE…

releasessecurity

Sources

• T1CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoderRapid726 Oct, 17:32

Vulnerabilities

• CVE-2026-111497