Critical Severity
CVE-2026-111497
Published: Oct 26, 2026
CVE-2026-111497 – Node.js Brotli Decoder OOB Write (CVSS 9.2) | Red/Blue Team suite for unpatched Node.js 22.x, 24.x, 26.x. 2 tools: Full Exploit (patch detection, remote DoS, Brotli bomb, lab RCE), Blue Team Checker (errno differential, version fingerprint, WAF detection, reporting) Only Use Ethically Only <3
# CVE‑2026‑111497 – Node.js Brotli Decoder OOB Write Toolkit
[](https://www.python.org/downloads/)
[](https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator)
[](https://github.com/tc4dy)
[](https://nodejs.org)
> **Ethical Use Only – Authorized Testing**
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**
---
## Vulnerability Overview
**CVE‑2026‑111497** is a high-severity out-of-bounds write in the Brotli decoder bundled with Node.js. A malformed Brotli stream can cause the decoder to continue with invalid block state and write past an internal ring buffer, potentially leading to **remote code execution**.
### How it works
1. **Invalid block switch accepted** – the Brotli stream header declares a single block type, but a block switch is requested anyway. `DecodeBlockTypeAndLength()` returns `false` for two different conditions (input exhausted vs. format error), and the fast-path `BROTLI_SAFE` macro silently discards the return value [citation:4][citation:6].
2. **Decoder continues with corrupted state** – stale Huffman tree pointers and context maps are used, leading to an out-of-bounds write via `memmove16()` on the ring buffer [citation:4].
3. **16-byte controlled write** – the write lands at a signed 32-bit displacement from the ring buffer base, giving a bounded but controllable write primitive [citation:2].
4. **Attack surface** – any Node.js service that decompresses Brotli data the attacker controls: Express 5 + body-parser 2.x with `Content-Enco