Zurück zu den Sicherheitshinweisen

Node.js CVE-2026-111497: Buffer Overflow

CVE-2026-111497 is a Critical-rated (CVSS 9.2) buffer overflow in the Google Brotli decoder (c/dec/decode.c) affecting Brotli 1.0.3 through 1.2.0 on all platforms. Node.js bundles the affected decoder, so any Node.js application accepting Brotli-compressed input is exposed to memory disclosure, denial of service, or potentially arbitrary code execution from a crafted stream. Update Node.js to the October 2026 patched release (22.23.4 on the 22.x line, EasyApache 4 25.92 on cPanel servers) and restart the runtime; if you link Brotli directly, move to Brotli 1.0.10 or 1.1.1.

Critical 9.2 CVSS Aktiv ausgenutzt
Node.js

Was das unter einer SharedLicense-Lizenz bedeutet

A remote unauthenticated attacker who can submit a crafted Brotli-compressed stream can read adjacent process memory or crash the worker — session data, secrets and request traffic passing through the vulnerable decoder are all in scope, with code execution possible.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Node.js bundles the affected Brotli decoder, so Node.js applications accepting Brotli-compressed input are exposed until the runtime is updated (Node.js October 2026 security releases; EasyApache 4 ships the fix in ea-nodejs22 22.23.4, release 25.92). Brotli is fixed in 1.0.10 and 1.1.1 – any application linking a Brotli decoder in the affected range should update the library as well.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-111497

Reference: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Häufig gestellte Fragen

What is CVE-2026-111497?
It is a buffer overflow in Google Brotli's decoder (c/dec/decode.c) affecting Brotli 1.0.3 through 1.2.0 on all platforms, classified CWE-252. A remote unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause denial of service, or potentially execute arbitrary code. NVD rates it Critical 9.2 (CVSS v4.0), published October 22, 2026.
Which versions fix CVE-2026-111497?
The decoder fix landed in Google Brotli 1.0.10 and 1.1.1. Node.js bundles Brotli, so its October 2026 security releases carry the fix — on the Node.js 22 line that is 22.23.4, which EasyApache 4 ships as ea-nodejs22 in release 25.92. Any application linking a Brotli decoder in the affected range should rebuild against 1.0.10 / 1.1.1.
How do I patch it on an EasyApache 4 server?
Run yum update 'ea-*' or use WHM → EasyApache 4 → Update to reach release 25.92 or later (ea-nodejs22 22.23.4), then restart your Node.js applications so they run the patched runtime. PHP-based sites are not exposed through this CVE — it is the Brotli decoder in the Node runtime and any other application linking it.
Is CVE-2026-111497 being exploited in the wild?
No exploitation is confirmed in the NVD record (status Awaiting Analysis) and no CISA KEV listing exists for it so far. The Critical rating and pre-announcement exploit-tool chatter around the Node.js October 2026 releases make prompt patching the prudent move regardless.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

LiteSpeed 6.3.7 Build 8: Critical LSQUIC HTTP/3 Vulnerability — Patch Before November 16

2026-11-11

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen