Node.js and Brotli: a format error became an out-of-bounds write

Node.js release October 21, 2026. The Node.js project describes CVE-2026-111497 as an out-of-bounds write in the bundled Brotli decoder. A malformed compressed stream can cause an eight-byte internal buffer to be overrun, potentially resulting in crash, memory disclosure, or code execution. The statement “RCE possible” comes from the project; its advisory does not publish a reliable exploit chain. The technical question is rather: how can a format error that is supposed to stop decoding allow processing to continue writing?

A stream decoder must know how to distinguish waiting from failure

Brotli represents compressed data in the form of blocks and decoding commands. A decoder called on successive chunks cannot always finish immediately: when it is missing valid bytes, it returns a status such as “need more data”. On the other hand, if the bytes already read form an impossible combination depending on the format, it must reject the stream. These two states seem close to the caller, but their effect is opposite: the first authorizes the addition of data; the second must stop decoding.

In the described flaw, an invalid block transition was reported as a temporary need for additional input instead of a permanent error. So the streaming decoder kept adding bytes to an internal buffer of eight bytes. The logical state “I’m still waiting” became dangerous because it could repeat itself when physical space was exhausted. A check of only the sizes of the input or output stream would not necessarily have detected this problem: the violated limit is that of an intermediate buffer.

The mechanism is a faulty state transition followed by an unbounded write. The exact type of corrupted bytes around the buffer and the ability to control the execution flow depend on the memory placement and decoding path. A reproducible crash would prove corruption; it would not, alone, prove code execution. The Node.js advisory implicitly separates these results by presenting them as possible effects.

Who provides the dangerous bytes?

The condition given by Node.js is that the application decompresses, via node:zlib, Brotli data that the attacker can provide. This could be a received file, an HTTP body, or another stream if the application actually passes it to the decoder; the simple presence of Node.js in a service does not demonstrate that it accepts hostile Brotli. The defensive inventory must therefore spot decompression calls and track the origin of the bytes to them.

A permitted search can generate invalid Brotli streams, compare the behavior of vulnerable and patched versions under memory instrumentation, and then reduce the case to minimal block change. The patch analysis should check two separate things: the decoder returns a format error when the state is impossible, and no wait branch can write beyond eight bytes. The project credits two reporters and two reviewers in its advisory, but does not publish the original PoC in this bulletin; we therefore do not claim to reproduce their path of discovery.

Correct to the right level

The project has released Node.js 22.23.4, 24.22.1 and 26.12.1 for the affected branches. The update should target the runtime actually used in production, including container images and packaged executables that embed their own Node.js. Upstream filtering of file sizes can reduce some abuse, but it does not replace correcting the decoding state: a short input may already carry an invalid format transition.

This CVE illustrates a native code safety principle: “data is missing” is not an acceptable response to a contradiction already established by the parser. If the error state is confused with the wait state, a streaming loop can turn a few malformed bytes into memory corruption.

Primary source: Node.js security publication October 21, 2026.