What is the CVSS score and severity of CVE-2026-111497?

CVE-2026-111497 is rated CRITICAL with a CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-787 (Out-of-bounds Write).

CVE-2026-111497 CRITICAL · CVSS 9.8 · OpenJS Foundation — Node.js Runtime · 2026-10-27

CVE-2026-111497: Node.js Brotli Stream Decoder (zlib / brotli)

Q: What versions are affected by CVE-2026-111497?

CVE-2026-111497 affects Node.js 20.x, 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1 in Node.js Runtime (Node.js Brotli Stream Decoder (zlib / brotli)).

Q: How do I patch or remediate CVE-2026-111497?

To remediate CVE-2026-111497, upgrade to the patched release: Node.js v22.23.4, v24.22.1, v26.12.1 (or v20.20.4 / v22.22.4 / v24.16.0 / v25.10.0). Upgrade production Node.js runtimes immediately to patched October 2026 releases (v22.23.4+, v24.22.1+, or v26.12.1+). If immediate runtime upgrade is blocked, strip or reject inbound Content-Encoding: br headers at the reverse proxy, CDN, or ingress load balancer. Audit downstream runtimes and serverless containers that bundle or port Node.js zlib/Brotli stream bindings (including Bun < v1.4.4).

A critical heap out-of-bounds write in the Node.js native Brotli decompression stream allows unauthenticated remote attackers to corrupt V8/C++ heap structures via a crafted HTTP Content-Encoding: br payload, leading to remote code execution or immediate worker process crash.

Identifier

CVE-2026-111497

Vendor / Product

OpenJS Foundation · Node.js Runtime

Severity / CVSS

CRITICAL · CVSS 9.8

Vector / CWE

CWE-787 (Out-of-bounds Write)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected

Node.js 20.x, 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1

Patched Version

Node.js v22.23.4, v24.22.1, v26.12.1 (or v20.20.4 / v22.22.4 / v24.16.0 / v25.10.0)

Priority

P0 — Emergency Runtime Patch (Within 24 Hours)

Executive Summary & Technical Impact

Tracked under CVE-2026-111497 (CWE-787 (Out-of-bounds Write)), this vulnerability affects Node.js 20.x, 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1 and carries a severity score of 9.8 (CRITICAL). Engineering and security operations teams running Node.js Runtime should prioritize upgrading to Node.js v22.23.4, v24.22.1, v26.12.1 (or v20.20.4 / v22.22.4 / v24.16.0 / v25.10.0).

Remediation & Patch Guidance

Upgrade production Node.js runtimes immediately to patched October 2026 releases (v22.23.4+, v24.22.1+, or v26.12.1+).
If immediate runtime upgrade is blocked, strip or reject inbound Content-Encoding: br headers at the reverse proxy, CDN, or ingress load balancer.
Audit downstream runtimes and serverless containers that bundle or port Node.js zlib/Brotli stream bindings (including Bun < v1.4.4).

Frequently Asked Questions (CVE-2026-111497)

What versions are affected by CVE-2026-111497?

CVE-2026-111497 affects Node.js 20.x, 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1 in Node.js Runtime (Node.js Brotli Stream Decoder (zlib / brotli)).

How do I patch or remediate CVE-2026-111497?

Upgrade affected deployments to Node.js v22.23.4, v24.22.1, v26.12.1 (or v20.20.4 / v22.22.4 / v24.16.0 / v25.10.0) and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-111497?

CVE-2026-111497 is rated CRITICAL with a CVSS score of 9.8 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Full TechPulse Investigation

Node.js October 2026 Security Emergency: Brotli RCE (CVE-2026-111497) & TLS Validation Bypass

A deep technical breakdown of the October 2026 Node.js security releases addressing a critical out-of-bounds write in the bundled Brotli decoder and NUL byte DNS truncation.

Read full engineering post-mortem (7 min read) →