Node.js has patched CVE-2026-111497, a high-severity vulnerability in its Brotli decoder that can allow remote code execution when a server decompresses specially crafted Brotli data from an untrusted source. The issue matters most for applications that accept and decode Brotli streams, including potentially through HTTP request bodies. It was reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer.
The vulnerability is not a risk created by Brotli compression in general. The relevant exposure is in the decoder, where a server processes attacker-controlled compressed input. In that scenario, an unauthenticated attacker may be able to reach the vulnerable code without first signing in, depending on how the application receives and handles the data.
Node.js acknowledged the issue in its October 2026 security releases and issued patched versions across three supported release lines. Organizations running Node.js services should identify whether their deployed applications decode Brotli input from outside their trust boundary, then update the runtime used in production.
What CVE-2026-111497 changes for Node.js services
The key distinction is between serving compressed responses and decoding compressed content supplied to a server. The verified vulnerability concerns servers that decompress Brotli streams. A service that only sends Brotli-compressed responses is not, on that fact alone, shown to be exposed by the available research.
For teams operating APIs, web applications, gateways, or services that handle uploaded or proxied data, the practical question is straightforward: can untrusted input reach a Brotli decoder? HTTP bodies are one cited example. The answer may depend on application middleware, reverse proxies, request-processing code, and the runtime versions deployed in containers or hosted environments.
Node.js patched the vulnerability in the following releases:
| Node.js release line | Fixed version | Status in the verified release information |
|---|---|---|
| 26.x | 26.12.1 | Patched |
| 24.x | 24.22.1 | Patched |
| 22.x | 22.23.4 | Patched |
The same CVE also has wider ecosystem relevance. Istio and Envoy advisories reference the Brotli issue as fixed in Envoy. Bun, meanwhile, has active discussions and pull requests to incorporate the fix into its Brotli decoder. That difference is important for teams with mixed runtime stacks: a Node.js update does not automatically establish the patch status of a separate Bun or Envoy deployment.
Practical response steps
The available information supports a focused remediation process rather than a blanket assumption that every use of Brotli is vulnerable. Teams should:
- Inventory deployed Node.js versions across production services, workers, APIs, and other runtime environments.
- Update Node.js 26.x to 26.12.1, 24.x to 24.22.1, or 22.x to 22.23.4, as applicable.
- Identify services that decompress Brotli data received from users, clients, upstream services, or other untrusted sources.
- Confirm that production images and hosting environments are running the updated runtime, not merely that an update was made in local development.
- Review Envoy and Bun deployments separately, using their respective security and release information to establish whether the relevant fix has been incorporated.
This is also a reminder that compression handling can sit in less visible parts of an application stack. A development team may not call a Brotli decoder directly, while a proxy, middleware layer, or runtime component does. Mapping the path from inbound data to decompression is therefore more useful than relying on an assumption about whether an application "uses Brotli."
For businesses, the immediate priority is reducing the chance that externally supplied data reaches an unpatched decoder. Applying the Node.js release is the direct remediation for affected Node.js versions. Exposure assessment then helps teams prioritize systems that accept compressed input, especially internet-facing services where unauthenticated requests are possible.
If your applications exchange compressed payloads across APIs, proxies, and runtime services, Scalevise can help turn a patch alert into a clear remediation plan. Our API and system integration security review can map data flows, identify where untrusted content is decoded, and verify that production integrations use the intended runtime versions. This reduces manual investigation and helps teams focus fixes on the services that matter most. Request an integration security review today.
Frequently Asked Questions
What is CVE-2026-111497?
CVE-2026-111497 is a high-severity vulnerability in the Brotli decoder used by Node.js. Crafted Brotli data can enable remote code execution when a server decompresses untrusted Brotli streams.
Which Node.js versions fix the Brotli vulnerability?
Node.js fixed the issue in versions 26.12.1 for the 26.x line, 24.22.1 for the 24.x line, and 22.23.4 for the 22.x line.
Does every application that uses Brotli face this RCE risk?
No. The verified issue concerns Brotli decoding of crafted data from an untrusted source. Whether an application is exposed depends on whether such input can reach a vulnerable decoder.
What is the status for Envoy and Bun?
Istio and Envoy advisories reference the CVE as fixed in Envoy. Bun has active discussions and pull requests to incorporate the fix in its Brotli decoder, so teams should verify the status of their specific Bun deployment.
Who reported the vulnerability?
OpenAI Codex Security researchers Khai Tran and Sylvie Mayer reported the vulnerability.
Conclusion
CVE-2026-111497 is a confirmed remote code execution risk for unpatched Node.js services that decompress untrusted Brotli data. Updating to the applicable fixed Node.js release is the essential first step. Teams should then assess the real input paths in their applications and review Envoy or Bun environments independently, because patch status can differ across the wider Brotli ecosystem.
Top comments (0)