Brotli Attacks Raise the Stakes for Node.js
CISA added CVE-2026-111497 to its exploited-vulnerability catalogue on 27 October. The entry covers Google Brotli and records ransomware involvement as unknown.
Node.js rates the flaw high; exposure requires an application to decompress attacker-controlled input through node:zlib. Corrupted memory can mean a crash, disclosure or code execution. Finding an installed runtime alone does not establish exposure.
The upstream fixes are 22.23.4, 24.22.1 and 26.12.1 in their respective branches. Verify the distribution or application supplier’s package; replacing a system library does not prove a bundled runtime changed.
Component-level exploitation does not establish attacks against every Node.js deployment. The application’s input path remains decisive.
Verify which executable each service launches. The project says unsupported branches remain affected. The same release also addresses separate DNS and certificate checks.
