CVE-2026-111497

critical

Description

A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 26.x, 24.x, and 22.x. Thank you, to mcollina for reporting this vulnerability and thank you aduh95 for fixing it.

Details

Source: Mitre, NVD

Published: 2026-10-21

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

Detections

Analytics