Security researchers at Imperva have demonstrated a remote code execution (RCE) vulnerability in the official Node.js 24.22.0 Linux arm64 image. The flaw, tracked as CVE-2026-111497, resides in the bundled Brotli decoder library. By feeding specially crafted Brotli-compressed data to applications, attackers can trigger a heap buffer overflow and execute arbitrary code without requiring a custom build or debugger.

What should defenders do?

Update Node.js to a patched version where the bundled Brotli library has been updated or the vulnerable code path has been mitigated. Monitor Node.js security advisories for the specific patched release. Consider input validation or filtering for Brotli-compressed data in edge cases until patching is complete.

highCVE

Imperva Researchers Demonstrate Remote Code Execution in Node.js via Crafted Brotli Data

CVE-2026-111497 affects bundled Brotli decoder in official Node.js builds

Cyber.TechVoidPublished about 3 hours agoUpdated less than a minute ago1 min read

Imperva Researchers Demonstrate Remote Code Execution in Node.js via Crafted Brotli Data

Key Takeaways

Imperva researchers demonstrated RCE in Node.js 24.22.0 via crafted Brotli data (CVE-2026-111497).
The flaw resides in the bundled Brotli decoder and involves a heap buffer overflow.
Attackers can execute arbitrary code without requiring a custom build or debugger.
Node.js has disclosed the flaw; users should update to a patched version.

Related Security News

highCVE

Ruby Patches Three Onigmo Bugs Behind Four Critical GitLab RCE Flaws

Ruby has released point releases 4.0.9, 3.4.12, and 3.3.13 to fix three vulnerabilities in the Onigmo regular expression engine. These bugs underpin four critical CVEs (CVE-2026-45338 through CVE-2026-45341) that GitLab patched over the past month. A specially crafted regular expression pattern could corrupt memory during compilation, potentially enabling remote code execution on GitLab instances. Users are advised to upgrade Ruby to the patched versions immediately.

The Hacker Newsabout 2 hours ago1 min read

Imperva Researchers Demonstrate Remote Code Execution in Node.js via Crafted Brotli Data

Key Takeaways

Related Security News

Ruby Patches Three Onigmo Bugs Behind Four Critical GitLab RCE Flaws

Quick answers

Security Details

Sources

Critical Code Execution Vulnerability in Python Pillow Library via Crafted EPS Images

CISA Adds Collabora Online OS Command Injection Vulnerability to Known Exploited Catalog

Siemens RUGGEDCOM CROSSBOW Multiple Vulnerabilities Allow SQL Injection and Privilege Escalation

Siemens Industrial Edge App Publisher Vulnerabilities Enable Network-Based RCE

Siemens SIMATIC WinCC Database Privilege Escalation Vulnerability (CVE-2026-59241)