Node.js Brotli Decoder Remote Code Execution (CVE‑2026‑111497) – Critical Runtime Flaw
What It Is – A newly disclosed out‑of‑bounds write in Node.js’s bundled Brotli decoder allows an attacker to execute arbitrary code on any host running a vulnerable runtime. The flaw resides in the core runtime, not in application‑level packages.
Exploitability – No public proof‑of‑concept is yet available, but the vulnerability is classified as high severity and is exploitable remotely when a service processes untrusted Brotli‑compressed data. No vendor‑provided mitigations exist; upgrading to a patched Node.js version is the only remediation.
Affected Products – Node.js 22.x, 24.x, and 26.x (the three currently supported release lines). All other active versions (e.g., 20.x, 25.x) remain vulnerable and are unsupported. The flaw impacts any environment that embeds the runtime: host machines, containers, serverless functions, and single‑executable applications.
Why It Matters for Trust & Control Assurance
- Continuous Runtime Inventory – Knowing which hosts, containers, or functions run a vulnerable Node.js version is a prerequisite for demonstrating due‑diligence in a control‑centric audit.
- Patch‑to‑Evidence Workflow – Verifiable remediation (scanning before and after patch) provides defensible proof that the “Vulnerability Management” control objective is being met across frameworks.
- Supply‑Chain Visibility – The flaw lives in the runtime itself, bypassing traditional dependency‑checking tools; enterprises must extend their control coverage to runtime assets to satisfy governance requirements (e.g., NIST CSF Identify and Protect functions).
Recommended Actions
- Inventory all Node.js runtimes across servers, containers, and serverless workloads, including non‑standard install paths (nvm, bundled SEAs, etc.).
- Prioritize any internet‑facing instances for immediate upgrade to the patched 22.x, 24.x, or 26.x releases.
- Patch the runtime and re‑scan to confirm remediation; retain scan reports as audit evidence.
- Integrate runtime discovery into your continuous monitoring platform to catch future version drift.
Source: Qualys Blog – Node.js Patches Brotli Remote Code Execution Flaw