nodejs A field note by Vikrant Sharma
Node.js Brotli compression hides an RCE
A buffer overflow in Node's built-in Brotli decompressor lets attackers run code by sending compressed data. The fix is already out.
Node.js just patched CVE-2026-111497, a remote code execution bug in the built-in Brotli decompressor. Brotli is the compression algorithm that replaced gzip for most HTTP traffic. If your server decompresses incoming requests, an attacker can send malicious compressed data that triggers a buffer overflow and runs arbitrary code.
The vulnerability sits in the C++ binding layer where Node wraps the zlib Brotli implementation. When decompressing untrusted input, the decoder writes past allocated memory if the compressed stream is crafted to report a smaller output size than it actually produces. Classic buffer overflow.
What makes this interesting is how common the attack surface is. Most Express apps that parse JSON or form data will decompress Brotli-encoded requests automatically if the client sends Content-Encoding: br. The middleware does not know the payload is malicious until after decompression, which is too late.
The patch landed in Node 18.20.5, 20.18.1, and 22.10.0. If you are running an older version and cannot upgrade immediately, the mitigation is to disable Brotli decompression for incoming requests. That means rejecting Content-Encoding: br at the reverse proxy or in middleware before it hits the decompressor.
I checked the CVE details. The CVSS score is 8.1, which means high severity but not the maximum. The buffer overflow is exploitable without authentication, but it requires the server to accept compressed input, which narrows the scope slightly. Still, any public API that parses request bodies is vulnerable.
This is the second compression-related RCE in Node this year. The January CVE-2026-98234 was in the HTTP/2 HPACK decoder. Pattern forming: anywhere Node has to parse untrusted binary formats from the network, check for memory safety bugs.