Node.js | Brotli | Remote Code Execution | CVE-2026-111497
Source Material: Node.js Security Release; NVD CVE Record; CISA Known Exploited Vulnerabilities Catalog | Technology: Node.js runtime and bundled Brotli decoder | Targeting: Opportunistic
Executive Summary
Node.js released security updates for CVE-2026-111497, a memory-corruption vulnerability in the bundled Brotli decoder. A crafted Brotli-compressed stream can cause an out-of-bounds write and may allow an unauthenticated remote attacker to execute code in the affected Node.js process.
The vulnerability affects supported Node.js 22.x, 24.x, and 26.x releases. Fixed versions are 22.23.4, 24.22.1, and 26.12.1. End-of-life Node.js branches should be treated as affected and migrated to a supported, fixed release. Intelligence source reported demonstration of code execution against the official Node.js 24.22.0 Linux arm64 image through hostile Brotli responses consumed by fetch() and Brotli request bodies decoded by configured Express or body-parser middleware. Node.js 24.22.1 rejected the same input. Exploitation was not reliable on every attempt, and the research did not cover every platform or application configuration.
A public PoC is now available, increasing the likelihood of exploitation. At the time of publication, no credible malicious in-the-wild exploitation, associated threat actor, or CISA Known Exploited Vulnerabilities listing has been confirmed.
Threat Overview and Strategic Impact
The vulnerable path is reached when an application supplies attacker-controlled data to Node.js native Brotli decoder. Relevant exposure paths include:
- HTTP responses with Content-Encoding: br consumed by Node.js applications, including through built-in fetch().
- Incoming Brotli-compressed request bodies decoded by configured middleware such as Express 5 or body-parser 2.
- Direct application use of Brotli decompression APIs.
- Products, containers, appliances, or serverless artifacts that bundle an affected Node.js binary.
Merely receiving a Brotli request does not make a bare Node.js HTTP server exploitable; the application or middleware must decode the hostile content. Successful exploitation could execute code with the Node.js process privileges, exposing application secrets, database credentials, cloud tokens, writable data, and reachable internal services.
Node.js rates the vulnerability High. The GitHub Advisory Database currently displays a CVSS v4.0 score of 9.2 and Critical severity, with a network attack vector, no required privileges or user interaction, and attack requirements present. Customers should treat exposed Brotli-decoding services as an urgent remediation priority.
Security Hardening and Recommendations
- Identify every Node.js runtime: Include hosts, containers, serverless functions, CI/CD images, managed platforms, appliances, development systems, and embedded application bundles.
- Deploy fixed releases: Upgrade to Node.js 22.23.4, 24.22.1, 26.12.1, or later. Rebuild and redeploy containers instead of changing only source manifests or version files.
- Validate the running binary: Check the Node.js version inside the deployed workload using node –version. Do not rely solely on host package inventories or package.json.
- Upgrade unsupported branches: Move end-of-life Node.js deployments to a supported fixed release line.
- Map Brotli exposure: Identify applications that decode untrusted compressed responses, request bodies, streams, files, or messages.
- Apply temporary controls: Where operationally feasible, disable or restrict untrusted Brotli decoding while updates roll out. Test changes against legitimate application traffic.
- Treat edge controls as temporary: WAF rules, removal of Brotli from accepted encodings, and proxy filtering do not replace the runtime update.
- Reduce exposure: Restrict Node.js process privileges, writable paths, outbound connectivity, cloud roles, secrets, and access to management networks.
- Review historical activity: Review relevant telemetry from October 21, 2026 through remediation for exploitation and post-exploitation behavior.
Detection Strategy
Detection should combine application, endpoint, container, and network evidence. Monitor for malformed or unusual `Content-Encoding: br` traffic, repeated Brotli decoding errors, abnormal Node.js exits, segmentation faults, and container restarts. Correlate suspicious Brotli traffic with process creation, file writes, credential access, or outbound network activity from the same workload. Prioritize instances where Node.js spawns shells, interpreters, download utilities, or system administration tools. Also monitor for unexpected file creation, permission changes, or persistence activity performed by Node.js service identities.
Identify outbound connections to rare or newly observed destinations, along with attempts to access cloud metadata endpoints or secret stores. These signals, especially when occurring alongside abnormal Brotli processing or Node.js behavior, should be investigated as potential indicators of exploitation or post-exploitation activity.
How Deepwatch Protects Our Customers
Deepwatch experts use available DNS, proxy, firewall, network, endpoint, and cloud telemetry to investigate exploitation and post-exploitation behaviors relevant to this advisory. Monitoring coverage depends on available data sources and does not replace upgrading the runtime. Customers should coordinate with the Deepwatch team to ensure that relevant Node.js hosts, containers, reverse proxies, WAFs, and cloud services are sending current telemetry and that process command-line and network visibility are enabled where supported.
Relevant Detections
Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.
Threat Hunting Leads
- Hunt for node spawning sh, bash, PowerShell, Python, Perl, curl, wget, or similar utilities.
- Correlate Brotli decoding errors, crashes, or restarts with process creation, file writes, or outbound traffic.
- Identify services accepting Brotli request bodies through Express or body-parser and confirm their deployed Node.js versions.
- Review built-in fetch() usage where responses originate from user-controlled, partner, webhook, proxy, or otherwise untrusted destinations.
- Search for new or modified executables, scripts, scheduled tasks, service definitions, SSH keys, containers, or user accounts created by Node.js service identities.
- Review access to environment files, application secrets, database credentials, cloud metadata services, and service-account tokens after suspicious requests.
Technical Artifacts
Please visit the Guardian Platform to access available technical artifacts for this report.
Threat Object Mapping
Intrusion Set:
- No intrusion set or threat actor has been attributed with active exploitation at this time.
Attack Pattern (MITRE ATT&CK/MITRE ATLAS):
| Tactic | Technique | Technique ID | Associated Threat Activity |
| Initial Access | Exploit Public-Facing Application | T1190 | Potential initial-access path where exposed applications decode hostile Brotli content. |
| Execution | Command and Scripting Interpreter | T1059 | Potential follow-on activity after successful code execution; not observed in a confirmed incident. |
| Persistence | Server Software Component: Web Shell | T1505.003 | Possible post-exploitation outcome; no web shell has been publicly linked to this CVE. |
Vulnerabilities:
- CVE-2026-111497
Malware/Tool:
- None publicly identified as of publication. No malware family or offensive tool has been credibly linked to use of the exploitation.
Additional Sources
- Node.js October 2026 Security Releases
- Imperva Node2Shell Analysis
- Public CVE-2026-111497 PoC Repository
- Upstream Brotli Fix Commit
- GitHub Advisory Database
- NVD CVE Record
- CISA Known Exploited Vulnerabilities Catalog
Share