Remote Code Execution via Brotli Decoder (CVE‑2026‑111497) Impacts Node.js and Multiple Platforms
What It Is — CVE‑2026‑111497 is a remotely exploitable out‑of‑bounds write flaw in Google’s Brotli compression library. When an application decompresses attacker‑controlled Brotli data via the node:zlib API, the flaw can corrupt process memory, leading to crashes, memory disclosure, or full remote code execution (RCE). The vulnerability was publicly disclosed by the Node.js project on 21 Oct 2026 and has since been confirmed with proof‑of‑concept exploits against official Node.js container images. Google released a fix to the Brotli source in February 2026 (versions 1.2.1, 1.1.1, 1.0.10), and Node.js incorporated the patch in 22.23.4, 24.22.1, and 26.12.1. Because Brotli is bundled with many runtimes—Node.js, .NET, Bun, Envoy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse—any software that decompresses untrusted Brotli streams is potentially vulnerable until rebuilt with the patched library.
Affected Products — Google Brotli (v1.0.10‑1.2.1), Node.js 22.x/24.x/26.x (and EOL 20.x/23.x/25.x), .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse, and downstream Linux distribution packages.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of secure software supply‑chain and dependency management; continuous verification that third‑party components are patched directly supports audit evidence across most frameworks. Capability: CONTROL_MAPPING.
Recommended Actions
- Identify all workloads that include the vulnerable Brotli decoder (SBOM scan, dependency‑track tools).
- Update to Brotli ≥ 1.2.1 (or the vendor‑specific patched package) and upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1.
- Rebuild container images, redeploy services, and restart affected processes.
- Verify runtime versions in production with continuous monitoring.
- Document the remediation steps as evidence for patch‑management controls.
Source: Help Net Security article