{"id":"BIT-node-2026-111497","details":"A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 22.x, 24.x, and 26.x.","aliases":["BIT-node-min-2026-111497","CVE-2026-111497","PYSEC-2026-4322","PYSEC-2026-4323"],"modified":"2026-10-23T13:40:35.253748907Z","published":"2026-10-23T08:48:26.837Z","database_specific":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"severity":"Critical"},"references":[{"type":"WEB","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"}],"affected":[{"package":{"name":"node","ecosystem":"Bitnami","purl":"pkg:bitnami/node"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.4"},{"introduced":"23.0.0"},{"fixed":"24.22.1"},{"introduced":"26.0.0"},{"fixed":"26.12.1"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/node/BIT-node-2026-111497.json"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}],"schema_version":"1.9.0"}