The Pulse
Codex Security Finds Node.js Brotli Flaw; Imperva Confirms RCE
OpenAI Codex Security researchers Khai Tran and Sylvie Mayer reported a high-severity flaw in Node.js’s bundled Brotli decoder. Imperva later demonstrated code execution on a vulnerable official Node.js build and confirmed the patched relea
AI.info Team · Written with AI · fact-checked ·
On October 22, Imperva demonstrated remote code execution through a flaw in Node.js’s Brotli decoder, two days after the Node.js project disclosed and patched the vulnerability. The researchers at OpenAI Codex Security credited with reporting the flaw are Khai Tran and Sylvie Mayer. Imperva’s proof of concept ran on an official, vulnerable Node.js build—not a specially weakened test binary—but only in its tested Linux arm64 setup.
How malformed Brotli input reaches Node.js
The vulnerability, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js. The project says an invalid block switch in malformed compressed data was treated as a temporary request for more input rather than a permanent format error. The streaming decoder then kept appending data to an eight-byte internal buffer, allowing memory corruption.
An attacker who can supply Brotli data that an application decompresses with
The Node.js Projectnode:zlibcan corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.
The risk depends on whether an application sends untrusted Brotli data into that decoder. Imperva demonstrated two routes: a Node.js service consuming a compressed response through its built-in fetch(), and configured request parsers decoding compressed incoming bodies. Receiving an HTTP request alone does not make a bare Node.js server decompress its body.
Imperva’s proof worked on Node.js 24.22.0
Imperva ran its proof of concept against the official Node.js 24.22.0 Linux arm64 image, using fresh containers without a debugger or instrumented build. Its test application created a marker file only after receiving the crafted Brotli input, providing evidence that code carried in the data ran inside the process. The same inputs were rejected by the patched 24.22.1 release.
The demonstration was not consistent on every attempt: Imperva said execution took multiple tries in its setup. Its tests covered the 24.22.0 build and specified application configurations; the team did not test every Node.js build, architecture or application. The results establish code execution in those tested conditions, not across every deployment.
On the request side, Imperva tested configured Express 5 and body-parser setups, including Express versions 5.0.0 through 5.3.0 and body-parser versions 2.0.0 through 2.3.0. The vulnerable code is in Node.js itself; those parsers provide a route for incoming compressed data to reach it. On the response side, the test used Node’s built-in fetch() to consume a Brotli-compressed response.
Three Node.js lines have fixes
The Node.js project released security updates on October 21 for its 22.x, 24.x and 26.x lines. The fixed releases are 22.23.4, 24.22.1 and 26.12.1. The project also warns that end-of-life Node.js versions are affected when a security release occurs, so applications on unsupported lines need to move to a supported release.
Imperva recommends checking the runtime inside deployed hosts and container images, including artifacts that bundle their own Node binary. Teams should identify where applications decompress untrusted Brotli data and update affected runtimes; restricting such traffic temporarily may help during rollout, but the runtime update addresses the decoder flaw. In Imperva’s tests, the fixed 24.22.1 build rejected the inputs that achieved code execution on 24.22.0.