Vulnerability of 27 October 2026 · CVE-2026-111497

Node.js Out-of-bounds write

9.8 CVSS · criticalExploited

Out-of-bounds write in Node.js. Exploitable over the network, without logging in, without any user action. CVSS 9.8 (critical). According to CISA it is already being exploited. Fixed in 22.23.4, 24.22.1 and 26.12.1.

Vendor security advisory

nodejs.org · The vendor’s information prevails.

At a glance

CVE

CVE-2026-111497

Product

Node.js

Vendor

OpenJS Foundation

Affected versions

< 22.23.4
≥ 23.0.0, < 24.22.1
≥ 25.0.0, < 26.12.1

per NVD

Fixed in

22.23.4, 24.22.1, 26.12.1

CVSS

9.8 (critical)
CVSS 3.1, scored by NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known exploited

Yes, per CISA (in the KEV catalog since 27 October 2026)

Weakness type

CWE-252, CWE-787 (Out-of-bounds write)

Published

22 October 2026

Last modified

30 October 2026

What to do

Update to a fixed version: 22.23.4, 24.22.1 and 26.12.1 or later, depending on the release line you run.
Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
Since it is already exploited: after updating, check whether the system was compromised before.
Also check test, staging and forgotten installations of the same software.

Vendor security advisory ↗

Original description

From the CVE record. The summary above is built from the structured data.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Name at CISA: Google Brotli Unchecked Return Value Vulnerability

Official references

github.com/andybalholm/brotli/releases/tag/v1.2.7Release notes
nodejs.org/en/blog/vulnerability/october-2026-security-releasesThird-party advisory
broccoli2shell.comThird-party advisory
github.com/advisories/GHSA-9v8h-qqgm-4m35Third-party advisory
github.com/dotnet/announcements/issues/494IssueMitigationThird-party advisory
github.com/google/brotli/releases/tag/v1.0.10Release notes
github.com/google/brotli/releases/tag/v1.1.1Release notes
github.com/google/brotli/releases/tag/v1.2.1Release notes
lists.debian.org/debian-lts-announce/2026/10/msg00049.htmlMailing listThird-party advisory
patchtheplanet.org/brotliThird-party advisory
aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497Third-party advisory
cert-portal.siemens.com/productcert/html/ssa-045512.htmlThird-party advisory
cert-portal.siemens.com/productcert/html/ssa-443410.htmlThird-party advisory
cert-portal.siemens.com/productcert/html/ssa-898633.htmlThird-party advisory
ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-buildsThird-party advisory
cisa.gov/known-exploited-vulnerabilities-catalogUS government

Sources

Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 1 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.

NVD entry ↗CVE.org record ↗CISA KEV catalog ↗

Which software versions does your website give away? The free security check finds out.

Check for free