- Node.js uses a built-in decoder when it decompresses Brotli-compressed data. When this decoder received malformed input, it could write outside its internal buffer. The issue was fixed on October 21, 2026 in a Node.js security release as CVE-2026-111497. The impact description (crash, memory exposure, possible remote code execution) is quoted from the Node.js vulnerability advisory.
- The cause was that an error in a block switch (an instruction to change the compression table used for the next section) was handled as a return value such as 'more input needed'. According to the quoted advisory, this caused the malformed data to be treated as a temporary state, and input kept accumulating in the internal buffer.
- On the unsafe execution path, where enough input was available, the same error was not passed to the caller and was ignored. The fix changed the return type to an error code enum and added the new error code BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, so both paths now stop processing immediately when an error occurs.
- The core of the fix is bringing the upstream google/brotli commit into Node.js. This article is an explanation written after reading the fix commit. The attack path and the actual scope of harm are not covered in the original text.
O: Backend engineers who handle externally uploaded files decompressed with zlib on our internal Node.js servers may find this article useful for locating where brotliDecompressSync is used and checking whether the announced fixed version has been applied.
X: The original text relies on the Node.js advisory for its impact description and does not specify the affected or fixed versions, so the actual fixed version should be confirmed directly from the advisory and release notes.