Runtime vulnerability, severity high
Node.js native Brotli decoder RCE and memory disclosure (CVE-2026-111497)
Published , updated
CVE-2026-111497 is a buffer overflow in the native Brotli decompression library, first addressed in the Node.js October 2026 security releases. Decoding specially crafted Brotli input could let a third party run code or read process memory in an affected application. AWS says the issue extends beyond Node.js to other Brotli decoders, and fixes from other vendors are not yet fully available.
What's affected
- node runtime>=22.0.0 <22.23.4; >=24.0.0 <24.22.1; >=26.0.0 <26.12.1
What to do
- Upgrade self-managed Node.js to 22.23.4, 24.22.1, 26.12.1 or later.
- On AWS Lambda, rebuild and redeploy container functions from the updated base image, and update ZIP function code or configuration to pick up the patched runtime.
- Check whether your code, dependencies or layers bundle their own Brotli library and update them as fixes become available. If no patch exists, disable Brotli decoding.
- Migrate workloads on end-of-life Node.js versions such as 18 and 20, which receive no security updates.
- If you cannot update immediately, block inbound requests with Content-Encoding br using an AWS WAF rule, noting that this also blocks legitimate Brotli uploads.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident nodejs-brotli-decoder-rce-2026-10References
Notice nodejs-brotli-decoder-rce-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.