CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

Reported by Rapid7

Summary by Cyber Security News26 Oct 2026, 18:32 CET

About this summary. This is a short excerpt from the description that Rapid7 published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder

OverviewOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2.

Read the full article at Rapid7 →

Source attribution: headline and facts are from Rapid7 (rapid7.com). Summary method: excerpt of the source description. See our source attribution policy.