Is CVE-2026-111497 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-111497

Update Node.js to a patched version where the bundled Brotli library has been updated or the vulnerable code path has been mitigated. Monitor Node.js security advisories for the specific patched release. Consider input validation or filtering for Brotli-compressed data in edge cases until patching is complete.

Quick answers

What is CVE-2026-111497?: Update Node.js to a patched version where the bundled Brotli library has been updated or the vulnerable code path has been mitigated. Monitor Node.js security advisories for the specific patched release. Consider input validation or filtering for Brotli-compressed data in edge cases until patching is complete.
How severe is CVE-2026-111497?: high
Is CVE-2026-111497 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-111497 be mitigated?: Update Node.js to a patched version where the bundled Brotli library has been updated or the vulnerable code path has been mitigated. Monitor Node.js security advisories for the specific patched release. Consider input validation or filtering for Brotli-compressed data in edge cases until patching is complete.

CVSS

—

Vendor

Node.js

Published

Oct 24, 2026 · 05:33

Patch

Unknown / not confirmed

Affected products

Node.js

Mitigation

Imperva Researchers Demonstrate Remote Code Execution in Node.js via Crafted Brotli Data

Security researchers at Imperva have demonstrated a remote code execution (RCE) vulnerability in the official Node.js 24.22.0 Linux arm64 image. The flaw, tracked as CVE-2026-111497, resides in the bundled Brotli decoder library. By feeding specially crafted Brotli-compressed data to applications, attackers can trigger a heap buffer overflow and execute arbitrary code without requiring a custom build or debugger.

11m

CVE-2026-111497

Quick answers

Related News

Imperva Researchers Demonstrate Remote Code Execution in Node.js via Crafted Brotli Data