CVE-2026-111497Vulnerability
Reported by 2 independent sources · first reported by The Hacker News · last reported
Last reported today
What the reports say
4 reports, newest first · the exact sentence from each-
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software“Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially causing a crash, a memory leak, or the execution of attacker-controlled code.”
-
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do“The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution.”
-
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data“…ial Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497).”
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions“CVE-2026-111497”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-106069, CVE-2026-105483, CVE-2026-105482, CVE-2026-106074, CVE-2026-105481, CVE-2026-106072, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073
Thanks — we review every report.