CVE-2026-111497 reached the National Vulnerability Database on 22 October 2026. It is a buffer overflow in the Brotli decoder, in the file c/dec/decode.c, affecting versions 1.0.3 through 1.2.0 on all platforms, and fixed in 1.0.10, 1.1.1 and 1.2.1.

Three bodies scored it three ways. NVD gave it 9.8 CRITICAL as its own primary assessment. Google, as the numbering authority, gave 9.2 under CVSS 4.0 and assigned CWE-252 and CWE-787. Node.js, which bundles the library, called it high and made no exploitation claim at all.

Brotli is not an obscure dependency. It is the compression the web runs on, bundled in every major browser and in Node.js itself.

What the bug is

Node.js describes it in one sentence, and it is the clearest description published anywhere: "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer."

A malformed stream says something the decoder cannot parse. The decoder answers, in effect, send me more. The sender does. The buffer is eight bytes long.

Who found it

The Node.js advisory credits it like this, word for word: "Thank you, to OpenAI Codex Security - Khai Tran and Sylvie Mayer for reporting this vulnerability and thank you mcollina and aduh95 for fixing it."

An AI lab's security team found a memory-safety bug in the compression library that ships inside every browser. That is worth noting without inflating it, and it is the second credit of that kind we have written up in a fortnight.

The 236 days

This part we checked in Google's own repository rather than taking it from the tracker that pointed us at it, and the primary record is better evidence than the claim was.

Commit 0ed4268a44 was pushed on 27 February 2026 at 13:10 UTC. Its message, in full: "Detect and report invalid stream earlier."

It changes DecodeBlockTypeAndLength from returning BROTLI_BOOL to returning BrotliDecoderErrorCode, replaces a bare false with a real error, and registers that error in the public header as BROTLI_ERROR_CODE with the name BLOCK_SWITCH and the value -17. It converts every block-switch function in the decoder the same way. 58 lines added and 29 removed in decode.c, 59 and 32 across the commit.

That is the fix. The new error code is precisely the thing the decoder now returns instead of asking for more input.

The releases carrying it, v1.0.10, v1.1.1 and v1.2.1, were all published on 21 October 2026. The previous release, v1.2.0, was 27 October 2025.

So the fix sat in public master, in a repository anyone can clone, for 236 days with no release carrying it. A second commit, 1260a29899, landed on release day with the message "Fix return type." It is one line: a function missed in February. Cleanup, not the fix.

Neither message says security

This is the part that makes it a story rather than a complaint.

"Detect and report invalid stream earlier." and "Fix return type." are both ordinary robustness housekeeping to read. No CVE, no advisory, no mention of a vulnerability, no hint that the change closes a memory-safety hole in a library with a billion installations.

The fix was legible to anyone who diffs decoder error paths looking for exactly this shape of change, and it was legible for eight months while every released version stayed vulnerable. Silent patching is not a secret. It is a race nobody told the defenders they had entered.

On the exploitation claims, which are not the same claim

Two very different things are circulating and they are being merged.

Imperva's Ron Masas is reported to have run attacker-supplied code on an unmodified Node.js 24.22.0 image on arm64 Linux, both as a fetched response and as an Express request body, and to have said it took several attempts. That exploit has not been released.

Separately, a public proof of concept on GitHub reportedly reaches code execution only against a deliberately weakened build, and otherwise crashes or leaks a limited amount of memory.

Working private exploitation and a public demo that needs the target weakened first are not interchangeable facts, and anyone deciding how fast to patch should know which one they are reading.

What to do

  • Update to 1.0.10, 1.1.1 or 1.2.1, and update Node.js to v22.23.4, v24.22.1 or v26.12.1, which carry the bundled fix.
  • Search your dependency tree for the vendored copy rather than the package. Brotli is statically linked into a great deal of software that does not list it.
  • Treat anything that decompresses untrusted Brotli as the exposed surface. A fetched response body counts.
  • If you maintain a library, ship the release when you ship the fix. The gap is the exposure.

What is not established

  • Whether anyone exploited this before October. Nobody has claimed it.
  • Whether the 236-day gap was a decision or an oversight. No statement from the maintainers explains it.
  • Whether remote code execution is reliably achievable against ordinary builds. The only such claim is private and unreleased.
  • Why NVD and Google differ by six-tenths of a point. Both scores stand on the record.
  • Which downstream products are still shipping an affected version.