A vulnerability in Google’s Brotli compression library could allow attackers to execute arbitrary code in applications that use an affected Brotli decoder to process compressed data.
Tracked as CVE-2026-111497, the high-severity flaw was first flagged in the Brotli decoder bundled with Node.js. The issue stems from an out-of-bounds write that can corrupt process memory, potentially leading to remote code execution (RCE), information disclosure, or denial of service (DoS).
The Node.js project disclosed the vulnerability on October 21, 2026, alongside security updates for its 22.x, 24.x, and 26.x release lines. The exposure, however, extended beyond Node.js, forcing Microsoft to release out-of-band security updates for.NET on October 25 to address the same CVE in its Brotli decompression implementation.
