Security Update Advisory for Google Brotli and Node.Js (CVE-2026-111497)
Overview
CVE-2026-111497, an out-of-bounds write vulnerability (a vulnerability where data is written outside the memory bounds) in the Google Brotli decoder, has been resolved. The CVSS score for this vulnerability was reported as 9.2.
Affected Products
- Google Brotli 1.0.3 Through 1.0.10.
- Google Brotli 1.1.0 Through 1.1.1.
- Google Brotli 1.2.0 Through 1.2.1.
- Node.Js 22.X, versions prior to 22.23.4.
- Node.Js 24.X, versions prior to 24.22.1.
- Node.Js 26.X, versions prior to 26.12.1.
Resolution and Action
Vulnerability Patches have been released in the latest updates. Google Brotli must be updated to version 1.0.10 Or later, 1.1.1 Or later, or 1.2.1 Or later. Node.Js must be updated to version 22.23.4 Or later, 24.22.1 Or later, or 26.12.1 Or later.
References
Reference sites include NVD CVE-2026-111497, Node.Js October 2026 Security Releases, Node.Js 22.23.4 Security Release, Node.Js 24.22.1 Security Release, Node.Js 26.12.1 Security Release, and GitHub Security Advisory GHSA-9v8h-qqgm-4m35 have been provided as reference sites.
