A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before…

At a glance

Node.js: Red, act today. A buffer overflow vulnerability in the Brotli decoder of Google Brotli versions 1.0.3 through 1.2.0 allows a remote unauthenticated attacker to potentially execute arbitrary code or cause a denial of service.

The flaws

• CVE-2026-48931: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before… (CVSS 3.7 · EPSS 0%)
• CVE-2026-111497: Out-of-bounds write can lead to remote code execution (CVSS 9.2 · EPSS 1%)
• CVE-2026-48930: Access control flaw (CVSS 9.8 · EPSS 0%)
• CVE-2026-48618: Authentication bypass (CVSS 6.5 · EPSS 3%)

The fix

Fix: Update to the latest available version: 1.0.10 or 1.1.1 or 1.2.1

Who is exposed: {'product': 'Google Brotli', 'packages': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1'], 'versions': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.10', '1.1.0', '1.1.1', '1.2.0', '1.2.1']}

Where it stands

• Exploitation reported in the press
• 1 outlet covering it

How it unfolded

1. 21 Oct, Node.js security releases (official): Wednesday, October 21, 2026 Security Releases
2. 23 Oct, The Hacker News (press): Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
3. 24 Oct, The Hacker News (press): Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Connects to

• Same weakness: CWE-367 (CWE-367). 47 other warnings in 30 days
• Same product: Earlier Node.js warnings. 11 in the last 90 days