CVE-2026-111497 is a critical-severity vulnerability. AttackerView checks Node.js sites for it with a live exploit check.
Detects Node.js servers whose bundled Brotli decoder keeps going after it has already decided the compressed data is invalid. When a Brotli stream asks to switch block type in a category that declared only one, the decoder correctly refuses, but on its fast path the refusal was thrown away, so decoding continued with a length counter that was never refilled and state that was never updated. Google, who maintain Brotli, describe the result as corruption of memory next to the decoder, which can disclose memory contents and can lead to remote code execution. Node.js reaches it with no application mistake required: Express 5 and body parser 2.x inflate Brotli compressed request bodies by default, and fetch() inflates Brotli responses through the same code, so calling out to an untrusted URL is exposed as well. The check sends three request bodies and compares the answers. The first is ordinary valid Brotli, the second is Brotli every release rejects, and that pair establishes that the route really does inflate request bodies rather than passing them through. The third asks for the impossible block switch and carries a nonce generated for this scan. A patched server answers it the way it answers invalid data; an affected server accepts it, and where the route echoes its body it hands the nonce straight back. The probe stops at the discarded refusal and never drives the out of bounds write, decodes to nine bytes so it cannot exhaust memory, and is sent at most once per host. CVSS 9.2. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, or rebuild against Brotli 1.0.10, 1.1.1 or 1.2.1.
Is your app exploitable through CVE-2026-111497?
Scan your domain free