Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-111497

Node.js: out-of-bounds write can lead to remote code execution

Risk score
86/100
CVSS
9.2 v4.0
Exploit chance (30 days)
0.7%
Published
21 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A buffer overflow vulnerability in the Brotli decoder of Google Brotli versions 1.0.3 through 1.2.0 allows a remote unauthenticated attacker to potentially execute arbitrary code or cause a denial of service.
Affected
{'product': 'Google Brotli', 'packages': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1'], 'versions': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1']}
Fix
Update to the latest available version: 1.0.10 or 1.1.1 or 1.2.1
Exploitation
Exploitation reported in the press

Not confirmed. 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0 isn't in the advisory. Check the vendor's advisory before acting on this.

Story map

Story map: Node.jsTHE FLAWSTHE FIXCVE-2026-111497Out-of-bounds write can leadto remote code executionCVSS 9.2 · EPSS 1%CVE-2026-48930Access control flawCVSS 9.8 · EPSS 0%CVE-2026-48618Authentication bypassCVSS 6.5 · EPSS 3%CVE-2026-105482Access control flawCVSS 7.4 · EPSS 0%FixUpdate to the latest availableversion: 1.0.10 or 1.1.1 or 1.2.1Who is exposed{'product': 'Google Brotli','packages': ['1.0.3', '1.0.4','1.0.5', '1.0.6', '1.0.7', '1.0.8','1.0.9', '1.0.10', '1.1.0', '1.1.1','1.2.0', '1.2.1'], 'versions'…RED · ACT TODAYNode.jsA buffer overflow vulnerabilityin the Brotli decoder of GoogleBrotli versions 1.0.3 through1.2.0 allows a remoteunauthenticated attacker topotentially execute arbitrarycode or cause a denial of service.Where it standsExploitation reported in the press1 outlet covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.21 Oct · Node.js security releasesWednesday, October 21, 2026 Security Releases23 Oct · The Hacker NewsResearchers Demonstrate Node2Shell RCE Exploiton Node.js Build Using Crafted Brotli Data24 Oct · The Hacker NewsBrotli Decoder Flaw Behind Node.js RCE AlsoAffects Bun, Python and Other Widely UsedSoftwareCONNECTS TOSame weaknessCWE-252 (CWE-252)11 other warnings in 30 days →Same productEarlier Node.js warnings11 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Node.js: Red, act today. A buffer overflow vulnerability in the Brotli decoder of Google Brotli versions 1.0.3 through 1.2.0 allows a remote unauthenticated attacker to potentially execute arbitrary code or cause a denial of service.

The flaws

The fix

Fix: Update to the latest available version: 1.0.10 or 1.1.1 or 1.2.1

Who is exposed: {'product': 'Google Brotli', 'packages': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1'], 'versions': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1']}

Where it stands

  • Exploitation reported in the press
  • 1 outlet covering it

How it unfolded

  1. 21 Oct, Node.js security releases (official): Wednesday, October 21, 2026 Security Releases
  2. 23 Oct, The Hacker News (press): Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
  3. 24 Oct, The Hacker News (press): Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Connects to

In the news

TL;DR

Critical buffer overflow vulnerability in Google Brotli versions 1.0.3-1.2.0 on all platforms, allowing remote unauthenticated RCE.

  • The Hacker News reports that the vulnerability also affects Bun, Python, and other widely used software.
  • The Hacker News reports that researchers have demonstrated a Node2Shell RCE exploit on Node.js using crafted Brotli data.
  • No workarounds or mitigations are mentioned in the provided articles.
  • No information is available on the scale of exploitation in the wild or the identity of attackers.

AI summary of 2 articles.

Why it is Red

  • CVSS 9.2 critical
  • Remotely exploitable without logging in
  • On your watchlist: node.js
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Last activity 22 Oct 2026. Patch Forecast updates every hour.