Node.js has shipped security updates for a Brotli decompression flaw that can turn attacker-controlled compressed data into memory corruption and potentially remote code execution. The Node.js project says CVE-2026-111497 affects its supported 22.x, 24.x and 26.x release lines. Fixed versions are 22.23.4, 24.22.1 and 26.12.1.

The bug sits below ordinary application code. A malformed Brotli stream can make Node's bundled decoder treat an impossible block transition as a request for more input. Processing continues, bytes spill beyond an internal buffer, and the process can crash, expose memory or run supplied code. That is a substantial consequence for a compression feature that often operates invisibly inside HTTP clients and web middleware.

The code-execution risk is no longer theoretical

Imperva's Red Team independently demonstrated code execution against the official Node.js 24.22.0 Linux arm64 image. Researchers reached the vulnerable decoder through two paths: a Brotli-compressed response consumed by Node's built-in fetch function and incoming compressed request bodies handled by tested Express and body-parser configurations. The same inputs were rejected by Node.js 24.22.1.

The demonstration has useful limits. Imperva did not test every platform or application, and its exploit did not succeed on every attempt. A bare Node.js HTTP server also does not automatically decode an incoming Brotli request merely because it receives one. Exposure depends on whether an application decompresses untrusted Brotli data, but that can happen on either side of an HTTP exchange and may be buried inside a framework or helper.

Singapore's Cyber Security Agency told affected users to patch immediately. NHS England's National Cyber Security Operations Centre likewise notes that a public proof of concept exists and assesses future exploitation as likely. The reviewed notices do not establish active attacks in the wild, so this is an urgent exposure story rather than a confirmed mass-compromise story.

Update the runtime you actually run

The repair is a Node.js runtime update, not an npm package bump. Operators should verify the Node version inside deployed containers, serverless images and packaged applications; an inventory of JavaScript dependencies can miss an older binary bundled underneath them. Rebuild images, restart workloads and confirm the running process reports 22.23.4, 24.22.1, 26.12.1 or a newer fixed release in the same supported line. End-of-life Node versions should move to a supported branch.

While updates roll out, teams can reduce exposure by limiting Brotli decompression on paths that accept untrusted input, provided the change is tested against legitimate traffic. Imperva says its WAF rules can block the exploit patterns it reproduced, but it still identifies the runtime update as the complete fix. A filter is a bridge, not a renovation. It buys deployment time; it does not remove the flawed decoder from the process handling compressed data.

TINA's view: compression is executable attack surface

TINA's view: The practical lesson is that infrastructure features deserve the same threat modeling as application endpoints. Compression looks like plumbing until a decoder processes hostile structure in native memory. Then a convenience negotiated in an HTTP header can become the shortest path to the process.

The case for urgency rests on three facts: supported Node lines are affected, working code execution has been demonstrated on an official build, and fixed releases already exist. The case against panic is equally specific: successful exploitation requires a reachable decompression path, the public test covered bounded configurations, and the cited sources do not confirm attacks in the wild. Patch promptly, map the actual Brotli paths, and resist converting a serious bug into an internet-wide apocalypse before the evidence earns it.

This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.