CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
// AI summary
Node.js 26.x, 24.x, and 22.x are affected by CVE-2026-111497, a critical out-of-bounds write in the Brotli decoder allowing an attacker to corrupt process memory.
// from the source
Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x , 24.x , and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2 . An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory. According to Node.j