Node.js patches Brotli RCE that spreads far past the runtime
A high-severity out-of-bounds write in Google's shared compression library, fixed in Node 22, 24, and 26, also reaches Envoy, browsers, and dozens of other consumers.
Node.js has shipped security releases for the 22, 24, and 26 lines to fix several high-severity flaws, the most consequential an out-of-bounds write in Brotli decompression that can allow remote code execution.
CVE-2026-111497 affects all three release lines. Matteo Collina reported it against Node.js; Antoine du Hamel fixed it there. The public Node.js advisory frames the bug as a Node defect, but the root cause sits in Google's brotli library. Google has published brotli 1.2.1 with the repair.
Jan Schaumann warned on the oss-security list that the same flaw is not confined to Node.js and already surfaces in other consumers, including Envoy. Follow-up tracking from Alan Coopersmith and community pages lists fixed or affected builds across Bun, Istio, Chromium, Firefox, the .NET runtime, ClickHouse, Ghostscript, Apache Arrow, PHP and Ruby Brotli bindings, woff2, and many more. Some projects absorbed the fix before disclosure simply by refreshing vendored copies. Schaumann also noted uneven vendor urgency: Ubuntu, for example, rates the CVE medium.
The same Node.js releases close three further high-severity issues. CVE-2026-105482 lets dns.resolve truncate names that contain a NUL byte. CVE-2026-105483 and CVE-2026-106069 are TLS hostname verification bypasses, one via fullwidth digits in an IP literal and one when a host loosely resolves to an address. A medium-severity keep-alive bug (CVE-2026-105481) can process a response written before the matching request. Dependency updates cover c-ares, OpenSSL (24 and 22), Undici, SQLite (22), and intermediate CA material tied to an eMudhra compromise.
Operators who do not run Node.js still need to inventory anything that decodes Brotli, especially statically linked or bundled copies.