Node.js: a memory bug in Brotli decompression can let an attacker take over the server
Identifiers: CVE-2026-111497 · CVSS 3.1 9.8 (scored by NVD)
What it is
Node.js ships Google's Brotli decompressor in node:zlib. Malformed Brotli data makes it write past the end of a buffer, so an app that decompresses data an attacker sends (an upload, a proxied response, a compressed request body) can crash, leak memory or run the attacker's code. CISA lists the Brotli flaw as exploited in the wild.
On CISA's Known Exploited Vulnerabilities list since October 27, 2026.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
Node.js itself (the runtime, not an npm package): check node --version, your CI's setup-node and your Dockerfile.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| Node.js | node | >= 22.0.0, < 22.23.4 >= 24.0.0, < 24.22.1 >= 26.0.0, < 26.12.1 | 22.23.4, 24.22.1, 26.12.1 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up node in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade Node.js itself (not an npm package) to 22.23.4, 24.22.1 or 26.12.1, on your machine, in CI (setup-node) and in your Dockerfile's FROM node:<version>. The advisory gives no workaround. Lines that reached end of life get no fix: move to a supported line.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.