# Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE (CVE-2026-111497) - Cloudflare Emergency WAF Rules

> CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js 22.x, 24.x and 26.x that can lead to remote code execution when untrusted Brotli data is decompressed. Node.js fixed it on 2026-10-21 (22.23.4, 24.22.1, 26.12.1) and Cloudflare shipped two Log-mode WAF rules on 2026-10-25.

- **Published:** 2026-10-26T19:36:40Z
- **Last reviewed:** 2026-10-26T19:36:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4481
- **ID:** TL-2026-4481
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111497

## Description

CVE-2026-111497 is a memory-corruption flaw (out-of-bounds write) in the Brotli decompression library bundled with Node.js. Per secondary analysis of the fix, a crafted compressed stream that declares a single block type and then performs a block switch was not rejected by the decoder, producing an out-of-bounds write. Node.js rated the issue High in its 2026-10-21 security release, which fixed 10 CVEs (four High) in versions 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life (Node.js 20 EOL 2026-04-30) and will not be patched. Builds that link a system Brotli older than upstream google/brotli commit 0ed4268 are also reported to be vulnerable.

Exposure is any code path that decompresses Brotli data from an untrusted party: zlib.brotliDecompress()/brotliDecompressSync() directly; server-side handling of requests carrying Content-Encoding: br (for example Express with body-parser); and fetch(), which negotiates Brotli by default - sending Accept-Encoding: identity does not help because a malicious server can still reply with Content-Encoding: br. Proxies that decompress Brotli responses are also in scope. No authentication is required for the server-side vector.

Exploitation status: one secondary source (Konfirmity) reports Imperva achieved code execution on 2026-10-22 through both a Brotli response fetched via fetch() and a Brotli request body processed by Express/body-parser, and that Node.js 24.22.1 rejects the same input; the same source reports no in-the-wild attacks as of 2026-10-25. SecurityOnline states Node.js does not report exploitation and that no public PoC is confirmed. The originating article references 'Node2Shell' exploit coverage showing code execution via crafted Brotli data; this could not be independently confirmed. Credit for the finding is attributed to Matteo Collina (Patchstack). Severity data conflicts across sources: Node.js rates it High; Patchstack lists CVSS 8.1; Konfirmity lists CVSS 4.0 9.2. No CVSS vector was available, so cvss_score is left null.

Cloudflare released two WAF rules on 2026-10-25, default action Log: one matching requests with Content-Encoding: br (rule ID ending ca706f3c) and one targeting the Next.js image optimizer path /_next/image (rule ID ending 402fe5bb). Cloudflare warns that existing action overrides could cause the new rules to block legitimate traffic immediately. Because the Content-Encoding: br rule is broad, it will match legitimate Brotli request bodies. No threat actor attribution, network IOCs or C2 infrastructure are reported; no network IOCs existed to check against BeaconBeagle.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter

## Sources

- [Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability](https://cybersecuritynews.com/cloudflare-release-brotli-vulnerability-waf-ruleset/)
- [Node.js 22.23.4 (LTS) Security Release](https://nodejs.org/en/blog/release/v22.23.4)
- [Node.js 24.22.1 (LTS) Security Release](https://nodejs.org/en/blog/release/v24.22.1)
- [Node.js October 2026 Security Release (SecurityOnline)](https://securityonline.info/nodejs-security-release-october-2026/)
- [Node.js October 2026 Security Releases (Konfirmity)](https://www.konfirmity.com/advisories/nodejs-october-2026-security-releases)
- [Node.js v24.22.1 fixes four HIGH CVEs (Brotli, TLS, DNS)](https://lilting.ch/en/articles/nodejs-tls-dns-brotli-security-release)
- [Patchstack: Node.js < 22.23.4 Remote Code Execution (CVE-2026-111497)](https://patchstack.com/database/npm/plugin/nodejs/vulnerability/node-js-22-23-4-24-22-1-26-12-1-out-of-bounds-write-in-the-bundled-brotli-decoder-leading-to-remote-code-execution)
- [Node.js Fixes 10 Flaws, 4 High, on the Same Day as PHP](https://fourweekmba.com/ai-node-js-fixes-10-flaws-4-high-on-the-same-day-as-php/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4481