1-minute read
What a defender needs to know
A malformed Brotli stream can overflow an eight-byte buffer in the decoder bundled with Node.js. Services that decompress attacker-controlled data through node:zlib are the priority: the resulting memory corruption can crash a process, disclose sensitive memory or potentially enable code execution. Google credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer for CVE-2026-111497. Rapid7 reports no known exploitation in the wild as of October 26.
Trace the actual untrusted Brotli-decompression entry points in your applications, including workers and ingest jobs. Rapid7 lists Node.js 22.23.4, 24.22.1 and 26.12.1 as the first fixed builds for the 22.x, 24.x and 26.x lines. Upgrade, rebuild and redeploy the affected services; move end-of-life installations to a supported fixed line. If a rollout must wait, restrict or disable paths that decode untrusted Brotli data until the updated processes are running. Other products bundling Google Brotli need their own downstream vendor fix.
Verify the live Node.js version in each affected service instance and confirm that its untrusted decode path now runs on a fixed build. A package scan can miss a stale running worker; verify both the live runtime and its untrusted decode path. Keep both the entry-point map and the live version results with the rollout.