CVE-2026-111497: Brotli corrupts memory wherever an app decompresses a stream
A bug in the Brotli decoder, versions 1.0.3 through 1.2.0. A compressed stream can corrupt process memory, leak data, crash it, or run code. Node is fixed in 22.23.4, 24.22.2, and 26.12.1. The 20 line will not get a patch.
Brotli is compression the web uses every day. CVE-2026-111497 sits in Google's decoder, versions 1.0.3 through 1.2.0. A crafted compressed stream corrupts memory next to the decoder. From there a leak, a crash, or code execution are possible. No login is required. The nickname Node2Shell in the feeds describes one common case, not the whole map: the same library is in Python, Java, Envoy, Bun, and distro packages.
Where this is your process
The risk shows up where your code decompresses Brotli from a place you do not trust. Typical doors: an incoming request body, and a response from a server your own fetch called. A file an employee opens locally is decoded by the same library if it is old. This is not "a hole in nginx in general." It is a hole in a specific libbrotli build or in Node's bundled decoder.
Versions
- The library: 1.0.10, 1.1.1, or 1.2.1, depending on the branch you already ship.
- Node.js: 22.23.4 and 26.12.1. On 24.x the first build with the fix was 24.22.1, it had a regression, and the working next step is 24.22.2.
- Node 20 and older are unsupported. Migrate. Do not wait for a patch.
- Rebuild the container. Updating the host does not change the Node inside the image.
Related Lexora services
Unclear whose Brotli is decompressing traffic
We can look at Node, the distro package, and images. "We updated the server" often touches none of the three.