Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)
khaled_ismaeel
15 points
2 comments
October 22, 2026
Related Discussions
Found 5 related stories in 112.2ms across 10,306 title embeddings via pgvector HNSW
- Node.js Brotli RCE (CVE-2026-111497) nthypes · 16 pts · October 21, 2026 · 93% similar
- Node.js October 21, 2026 Security Releases vwelling · 15 pts · October 21, 2026 · 62% similar
- Node.js: 5 vulnerabilities found, update now danfritz · 11 pts · October 22, 2026 · 60% similar
- PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) hayd · 113 pts · October 21, 2026 · 51% similar
- Critical Vulnerabilities in PHP defly · 21 pts · October 20, 2026 · 49% similar
Discussion Highlights (1 comments)
sippeangelo
From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?