Malformed Brotli input can write past an internal decoder buffer in node:zlib, letting an attacker who controls compressed data crash a process, leak memory or run code. Rated high and fixed in Node 22.23.4, 24.22.1 and 26.12.1 along with nine other CVEs and the eMudhra certificate update. Credited to OpenAI Codex Security.
What to do: Upgrade to 22.23.4, 24.22.1 or 26.12.1. The Brotli flaw reaches beyond Node.js: Bun, Python Brotli packages, Envoy and Istio are affected (THN Oct 24). OpenAI says it found the flaw during its red-teaming. Oct 26: Microsoft shipped emergency .NET patches; PHP rebuilt its Windows packages with Brotli 1.2.1 (cURL decompression path); FFmpeg is hit via crafted JPEG XL images; ClickHouse crashes on o…
AI angle: Found by OpenAI's Codex Security team, one of several October bugs credited to AI-assisted discovery.
Microsoft releases emergency .NET patches for critical Brotli flaw
Attackers can exploit a critical vulnerability affecting Node.js to execute arbitrary code remotely or disclose sensitive information on affected systems. Patch immediately. 🔗: https://t.co/THvj5OZwek https://t.co/JxloW
CERT-In has published Vulnerability Notes on its website. Multiple Vulnerabilities in Drupal Core https://t.co/oJi9tcIuoW Multiple Vulnerabilities in Node.js https://t.co/4UahVqYpcB Multiple Vulnerabilities in Drupal
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or
‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js. Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability. Read full details ↓ https://thehackernews.com
UPDATE: The Brotli flaw (CVE-2026-111497) goes beyond Node.js and web traffic. .NET: patched by Microsoft. FFmpeg: hit via a crafted JPEG XL image. ClickHouse: one request crashes it, fix not yet.
Why this score
Every supported Node.js release (impact 4), no public exploit (exploitability 0), general sector (criticality 0).