GoogleAnalysisNode.js patches critical Brotli decoder buffer overflow vulnerability
What happened.The Node.js project published emergency security updates across all active release lines to patch a critical out-of-bounds write buffer overflow vulnerability within the bundled Google Brotli compression decoder.
Why it matters.Node.js powers microservice edge gateways, API routers, and server-side rendering pipelines that routinely decompress untrusted user requests. Infrastructure teams must update Node container runtimes and backend worker images to patched releases before public exploit scripts proliferate.
The technical specifications:
- Defect mechanics: Tracked as CVE-2026-111497 with a 9.2 CVSS score, the flaw in the decoder library allows specially crafted compressed streams to overflow heap buffers during decompression.
- Exploit implications: Attackers submitting malformed compressed payloads to public HTTP endpoints can cause process crashes or achieve unauthenticated remote code execution within host runtime memory.
- Remediation releases: Maintainers issued patched runtimes in Node.js versions 22.23.4, 24.22.1, and 26.12.1, while standalone deployments must update Google Brotli library packages to versions 1.0.10, 1.1.1, or 1.2.1.