CVE-2026-111497

CVE-2026-111497 is a vulnerability affecting the Brotli decompression library integrated into Node.js (specifically within the 22.x, 24.x, and 26.x release lines) and other platforms like Envoy. The flaw is characterized as an out-of-bounds write memory error in the Brotli decoder. When a system decodes Brotli-compressed data, a bug in how the decoder unpacks the data allows it to write past the end of its allocated memory block. This memory corruption can be triggered when an application processes untrusted or malicious Brotli-compressed content, potentially allowing an attacker to leak memory or achieve remote code execution (RCE). To mitigate this issue, users are advised to update to patched versions of Node.js, which include 22.23.4, 24.22.1, and 26.12.1.