critical CVSS 9.8 Actively exploited EPSS 0.48%

CVE-2026-111497·Node.js vulnerability

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Severity
critical
Software
Node.js
Fixed in
26.12.1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.48% — higher than 41% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-111497 scores 9.8 on CVSS, so a successful attack would be serious — but at 0.48%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 25.0.0

Until: 26.12.1

Fixed in: 26.12.1

How to fix this CVE

Node.js versions 25.0.0 through 26.12.1 contain a critical buffer overflow in the bundled Brotli decoder that can lead to remote code execution when processing malicious compressed streams. Immediately upgrade to Node.js 26.12.1 or later to patch the vulnerable Brotli component. After upgrading, restart all Node.js application services to ensure the patched version is active.

sudo dnf update nodejs

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed Node.js version: node --version or nodejs --version
  2. Verify the version is in the vulnerable range: 25.0.0 to 26.12.1 (if so, the system is vulnerable)
  3. Search application logs for unusual decompression errors or crashes: grep -i 'brotli\|decompress\|buffer' /var/log/nodejs-app.log or equivalent application log path
  4. After patching, confirm version is >= 26.12.1: node --version and verify Node.js processes have been restarted with ps aux | grep node

FAQ

What is CVE-2026-111497?

CVE-2026-111497 is a critical buffer overflow flaw in Node.js's embedded Brotli decompression library that allows attackers to execute arbitrary code or crash services by sending specially crafted Brotli-compressed data over the network without authentication.

Is CVE-2026-111497 being actively exploited?

Yes, this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Immediate patching is strongly recommended.

What versions of Node.js are affected by CVE-2026-111497?

Node.js versions 25.0.0 through 26.12.1 are affected. Upgrade to 26.12.1 or later to receive the patch.

How do I check if my server is vulnerable to CVE-2026-111497?

Run node --version and compare the output against the affected range (25.0.0–26.12.1). If your version falls within this range, your server is vulnerable.

Does Defensia detect CVE-2026-111497?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Node.js is installed on a monitored server, CVE-2026-111497 will appear in your dashboard with remediation steps.

Related Node.js CVEs

CVE-2026-21636CVSS 10A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
CVE-2026-48930CVSS 9.8A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2025-55130CVSS 9.1A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2026-56846CVSS 9A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
CVE-2026-58042CVSS 9A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-111497. Free for 1 server.

Get started free