Brotli Bug CVE-2026-111497 Allows Code Execution on Node.js
Imperva demonstrated code execution on Node.js 24.22.0 for Linux ARM64; Node.js and Brotli have released patched versions.
A memory-corruption vulnerability in Google's Brotli compression library, tracked as CVE-2026-111497, was disclosed after Imperva researchers demonstrated code execution on Node.js 24.22.0 for Linux ARM64, according to dailysecu.com. Patched versions of Node.js and Brotli were released on October 21.
The flaw allows memory writes outside the intended buffer when decompressing malformed input. Exploitation can crash a program, leak memory contents and, in some cases, lead to remote code execution, according to the published findings.
Imperva named the vulnerability Node2Shell. The demonstration used two paths: a compressed response from an external server and a compressed request body. Successful exploitation required multiple attempts, and code execution was not proven on other operating systems or products. No real-world exploitation has been reported in published materials.
Envoy and Istio may be affected when Brotli decompression is enabled. In Python, HTTP libraries automatically decompress responses using the Brotli or brotlicffi packages if installed.
Node.js released fixed versions 22.23.4, 24.22.1 and 26.12.1 on October 21. Google Brotli shipped security fixes in versions 1.0.10, 1.1.1 and 1.2.1.
Quick answers
What is CVE-2026-111497?
It is a memory-corruption vulnerability in Google's Brotli compression library that allows memory writes outside the intended buffer when decompressing malformed input.
Which Node.js versions are patched?
Node.js released fixed versions 22.23.4, 24.22.1 and 26.12.1 on October 21.
Which Brotli versions contain the fix?
Google Brotli shipped security fixes in versions 1.0.10, 1.1.1 and 1.2.1.