CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
A critical flaw (CVE-2026-111497) has been disclosed in decoder.
A critical flaw (CVE-2026-111497) has been disclosed in decoder.
The affected service is reachable from the network without authentication.
decoder may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.
Anyone running decoder 1.0.3 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
Systems like this are placed at the edge of the network by design -- exactly where attackers scan first the moment a CVE is made public.
This is tracked as CVE-2026-111497 and rated critical severity, which is the identifier to use when checking vendor guidance.
The affected versions are 1.0.3, so that's the range to check against your own deployment.
A workaround exists, but there is no complete fix available yet.
Confirm whether decoder 1.0.3 is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
A critical flaw (CVE-2026-111497) has been disclosed in decoder.
The affected service is reachable from the network without authentication.
decoder may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.
Who is affected
Anyone running decoder 1.0.3 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.
Why it matters
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
Systems like this are placed at the edge of the network by design -- exactly where attackers scan first the moment a CVE is made public.
Technical details
This is tracked as CVE-2026-111497 and rated critical severity, which is the identifier to use when checking vendor guidance.
The affected versions are 1.0.3, so that's the range to check against your own deployment.
Response
A workaround exists, but there is no complete fix available yet.
What security teams should do
Confirm whether decoder 1.0.3 is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.