Node.js patches Brotli decoder buffer overflow reachable from untrusted streams

What happened

Node.js shipped patched builds for all three of its supported release lines on 21 October 2026 to close a buffer overflow in the Brotli decompression code it bundles. The vulnerability, CVE-2026-111497, originates in Google's Brotli library, but Node distributes its own copy through the node:zlib module, so any application that decompresses Brotli streams inside the runtime was exposed without having installed anything extra. According to a dev.to analysis of the advisory and the upstream fix, the bug turned a malformed block header into memory corruption.

An error mistaken for a request for more data

A Brotli stream is divided into blocks, and each block header tells the decoder how the following data is encoded. Malformed input can carry a block-switch value the format does not allow; the only correct response is to abort with a format error, because additional bytes cannot make an illegal value legal.

The dev.to write-up, examining the patch commit in Google's Brotli repository, reports that the decoder instead returned the status it normally uses to ask for more input. Streaming consequently continued, and the decoder kept appending bytes to an eight-byte internal buffer intended for the case where a few more bytes would finish a header. The write eventually ran past the end of that allocation. Google's CVE Program record, published 22 October 2026, classifies the issue under CWE-787, out-of-bounds write, and CWE-252, unchecked return value.

Which versions are affected

The CVE record names Google Brotli 1.0.3 through 1.2.0 on all platforms as vulnerable, with fixes in 1.0.10, 1.1.1 and 1.2.1 — three patched releases, one per maintained branch, which suggests the same correction was backported to each line. Anyone running a C build, a vendored copy or a language binding pinned inside that range is in scope.

The Node.js advisory lists the 26.x, 24.x and 22.x lines as affected and offers v26.12.1, v24.22.1 and v22.23.4 as fixed builds. It also warns that end-of-life releases carry the flaw and directs users to a current version.

How attacker data reaches the decoder

The CVE record describes the trigger as crafted Brotli data supplied by a remote, unauthenticated attacker. An OX Security analysis cited by the dev.to article traces how untrusted bytes arrive at the bundled decoder: a service that accepts request bodies sent with Content-Encoding: br decompresses data chosen by the caller, and a service that fetches a user-supplied URL faces the same exposure on the response side, since the HTTP client decodes the body before application code sees it. The advisory's wording covers proxies, CDNs and similar service types.

Severity, credit and the wider release

Google's record scores the issue 9.2 under CVSS 4.0, rating the confidentiality, integrity and availability impacts as high, while the Node.js advisory classifies the runtime issue as high rather than critical. The dev.to write-up flags that discrepancy and notes that neither source explains it. The score's AT:P component means an attack requires specific preconditions — in practice, the target has to actually run the crafted stream through the decoder.

The advisory credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with the report, with Node maintainers mcollina and aduh95 on the fix. Nine further advisories arrived in the same October release, covering issues including DNS name truncation, TLS hostname verification and predictable random values in snapshot builds, alongside dependency updates to c-ares, OpenSSL, SQLite, Undici and the CA bundle.

Why it matters

Decompression is invisible plumbing: services call node:zlib on routine request handling without treating it as an attack surface, and this flaw shows that a parsing error in a bundled C library can turn everyday traffic into a memory-corruption vector. The practical response is twofold. Node.js operators should move to one of the three fixed builds promptly, since end-of-life lines get no backport. Teams elsewhere — language bindings, vendored copies, embedded C builds — need to inventory anything using Brotli 1.0.3 through 1.2.0, because the upstream fixes exist only in 1.0.10, 1.1.1 and 1.2.1.