ddtcorex

23 Oct 2026 · 2 min read

Node.js Brotli RCE (CVE-2026-111497): malformed compression input to code execution

CVE-2026-111497 is an OOB write in Node's bundled Brotli decoder plus TLS bypasses. Upgrade to 22.23.4/24.22.1/26.12.1 now.

What happened

On 21 October 2026, Node.js released security updates for the 22.x, 24.x, and 26.x lines. The most severe issue, CVE-2026-111497 (NVD published 22 October), is a high-severity buffer-overflow in the bundled Brotli decoder (c/dec/decode.c, Brotli 1.0.3–1.2.0): malformed Brotli input causes an out-of-bounds write, letting a remote unauthenticated attacker corrupt adjacent memory — the classic prelude to code execution. The release fixes nine other issues, including two high-severity TLS hostname-verification bypasses.

Per the Vercel security bulletin of 21 October 2026, Vercel deployed WAF rules the same day blocking the inbound attack vector for hosted projects and is rolling patched runtimes — but WAF coverage explicitly does not replace patching, and fetched-response decompression is only covered by the runtime fix. Node.js 20 has reached end of life and will not receive the fix at all.

Impact

Any Node process that decodes attacker-controlled Brotli — request bodies, fetched upstream responses, asset pipelines — can be crashed or owned. For SSR storefronts (Next.js App Router and friends), that process renders every page and holds API tokens: compromise it and you own the storefront's output plus its secrets. The TLS bypasses compound the damage by letting attackers impersonate upstreams the server talks to.

Root cause in one paragraph

The vendored Brotli decoder trusted length fields in the compressed stream without validating them against the output buffer; a malformed stream wrote past the allocation, and because the decoder runs inside the Node process, a codec bug became a server bug.

What to do now

  • Upgrade to Node.js 22.23.4 / 24.22.1 / 26.12.1 now — external backends, self-hosted Next.js, container images, CI runners, and local dev alike.
  • Move off Node.js 20.x entirely: it is EOL and will never get this fix; switch version settings to 22.x or 24.x and redeploy.
  • Rebuild container images (a lockfile bump without a rebuilt image changes nothing) and restart all long-lived processes.
  • Rotate server-side secrets (Magento API tokens, payment keys) on hosts that ran vulnerable versions while exposed.
  • Audit where your code decompresses Brotli from untrusted sources — add size caps as defense in depth.

What this means for Magento stores

Headless Magento storefronts on Next.js/Nuxt run exactly this code: Node decompresses upstream Magento GraphQL responses and customer request bodies all day. A codec RCE there poisons every page and leaks the integration tokens in process.env. Patch the Node tier with the same urgency as PHP, keep runtimes off EOL, and re-verify ownership server-side in Magento even when the frontend vouches for the user.

Sources

securitycvenodejsjavascript