Node.js Brotli RCE: CVE-2026-111497, PoC Status and Fixes
I just wrote about PHP2Shell and PHP’s request-lifecycle bugs. Now Node.js has its own runtime security update to deal with. Different engine, different failure mode, same uncomfortable reminder: safe-looking application code still depends on native code underneath it. On 21 October 2026, Node.js released fixes for 10 CVEs. The one I want to spend time on is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that permits remote code execution. ...