Wiz Research published analysis on October 25, 2026 of CVE-2026-111497, a critical remote code execution vulnerability in the Brotli compression decoder library. Node.js is in the blast radius, along with any other runtime or server that embeds the Brotli decoder. Brotli is the dominant HTTP response compression algorithm in modern web stacks, which means this vulnerability touches a very large portion of exposed internet-facing services.
The Brotli decoder vulnerability
Brotli is a general-purpose lossless compression algorithm developed by Google and standardized in RFC 7932. It is the preferred compression method for HTTP responses in most modern web servers and content-delivery pipelines because it achieves better compression ratios than gzip at comparable speeds. CVE-2026-111497 is a flaw in the decoder side -- the component that decompresses incoming Brotli-encoded data. Wiz classified the vulnerability as critical and reported it allows remote code execution. The vulnerability is in the library itself, meaning any application that uses the library to decompress data received from the network is potentially exploitable.
Why the blast radius is wide
Node.js ships with Brotli decoder support built into its HTTP module and the zlib binding. Any Node.js service that accepts Brotli-compressed request bodies or decompresses Brotli-encoded responses is a potential attack surface. Beyond Node.js, Brotli is embedded in web servers, reverse proxies, CDN edge runtimes, and server-side rendering pipelines across multiple language ecosystems. The attack scenario is straightforward: craft a malicious Brotli-compressed payload and send it to any exposed service that decompresses Brotli input. The flaw in the decoder triggers on processing that input.
What to do right now
Check the Wiz blog post for the exact affected version ranges of the Brotli library and the patched Node.js version when Wiz publishes it. Upgrade Node.js to the patched version as soon as it is available. Identify all externally exposed services in your environment that use Node.js or embed the Brotli library -- this includes web application servers, API gateways, server-side rendering services, and any proxy layer that does Brotli decompression. If a patched version is not yet available, consider disabling Brotli content-encoding acceptance at the edge as a temporary mitigation: most CDNs and reverse proxies allow you to restrict accepted content-encoding values. Monitor the Wiz CVE page and Node.js security advisories for patch availability.
Gigia Tsiklauri is the founder of infosec.ge. Get in touch to report a vulnerability, submit a tip, or ask about coverage.