🚨Brotli Vulnerability Affects Node.js: CVE-2026-111497
Node.js users, your Brotli security is compromised
TL;DR
A critical vulnerability in Brotli affects Node.js processes, allowing memory leaks or code execution. Patches are available for Node.js 22.23.4, 24.22.1, and 26.12.1. Upgrade now to avoid risks.
A critical vulnerability in Brotli (CVE-2026-111497) was disclosed on October 21st, affecting Node.js processes that decompress attacker-controlled Brotli data. This can lead to severe issues like memory leaks or arbitrary code execution. If you're using Node.js, this is a big deal. The vulnerability has a CVSS v4.0 score of 9.2, making it critical. Affected versions range from 1.0.3 to 1.2.0 on all platforms. Patches are available for Node.js 22.23.4, 24.22.1, and 26.12.1, among others. Upgrade to mitigate risks.
Key Points
Brotli vulnerability (CVE-2026-111497) disclosed on October 21st, affecting Node.js processes.
Node.js processes decompressing attacker-controlled Brotli data can lead to memory leaks or code execution.
Vulnerability has a CVSS v4.0 score of 9.2, making it critical across all platforms.
Patches available for Node.js 22.23.4, 24.22.1, and 26.12.1, among other affected software.
Upgrade to mitigate risks; patches also available for Python, C++, bun, Envoy, and more.
Why It Matters
If you're using Node.js with Brotli, this vulnerability can lead to memory leaks or code execution. Upgrading to Node.js 22.23.4, 24.22.1, or 26.12.1 is crucial to avoid these risks. Other affected software like Python, C++, bun, Envoy, and more also have patches available.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,565 builders reading daily.