Technical Information

A remote unauthenticated attacker can exploit out-of-bounds write vulnerability in the Brotli decoder (`c/dec/decode.c`) bundled with node.js by providing a crafted Brotli-compressed stream to corrupt adjacent decoder state memory i.e, writing past the end of an internal decoder buffer, may disclose sensitive memory contents, cause a denial of service, or potentially remote code execution.

Patch release date: Oct 21, 2026
Further information on this vulnerability is available at : CVE-2026-111497