Imperva demonstrated remote code execution on stock Node.js 24 via an out-of-bounds write in the bundled Brotli decoder, CVE-2026-111497. Any service decompressing untrusted Brotli input risks full server compromise. #NodeJs #BrotliDecoder #AppSec
https://cyberworldops.eu/en/crafted-brotli-input-yields-code-execution-on-a-stock-nodejs-24-build
CyberWorldOpsImperva Demonstrates Brotli Code Execution in Node.jsImperva demonstrated crafted Brotli input causing code execution on a stock Node.js build via request and response paths, with fixes and limits explained.