Fedora Account System
Red Hat Associate
Red Hat Customer
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
RHEL 8 `nodejs:24` bundles Brotli 1.2.0 in `libnode.so` (`bundled(brotli) = 1.2.0`, no link to the system `libbrotli`), which is inside the 1.0.3–1.2.0 range in this bug's description. The CVE page marks `nodejs:24/nodejs` as Not affected, and there's no nodejs tracker. Please re-evaluate."
Additional detail: Node fixed CVE-2026-111497 in v24.22.1 by cherry-picking google/brotli 0ed4268a4401 into deps/brotli/c/dec/decode.c (nodejs/node commit 49dff6f57aa7) without changing version.h, which still says 1.2.0. nodejs-24.21.0's decode.c is byte-identical to upstream brotli v1.2.0, so it lacks the fix, and the nodejs-24.21.0-1.module+el8.10.0+24927 sources carry no brotli patch. The AlmaLinux rebuild's libnode.so uses the bundled decoder rather than the system libbrotli. The decoder is reachable through zlib.brotliDecompress / createBrotliDecompress and through fetch() with Content-Encoding: br, which this CVE's statement itself names. Please re-check nodejs:24 on RHEL 8.
Upstream brotli fix (master branch): https://github.com/google/brotli/commit/0ed4268a4401abcb44720963 Upstream fixed in 1.2, 1.1, and 1.0 branches, as used in version 1.2.1, 1.1.1, and 1.0.10: https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6 https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12 https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:90449 https://access.redhat.com/errata/RHSA-2026:90449
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:90495 https://access.redhat.com/errata/RHSA-2026:90495
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:90501 https://access.redhat.com/errata/RHSA-2026:90501
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:90889 https://access.redhat.com/errata/RHSA-2026:90889
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:90893 https://access.redhat.com/errata/RHSA-2026:90893
@jorris thank you for the update and the follow up , two things are spotted on my end : - the latest UBI8 built today was using the unpatched brotli 1.0.6-4 ( link for the latest built https://catalog.redhat.com/en/software/containers/ubi8/5c647760bed8bd28d0e38f9f?image=6ae0728b331e520a65ff9977&architecture=amd64#packages ) - the other point is the OVAL feed is not reflecting that this is the patched release : https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/x86_64/baseos/os/Packages/b/brotli-1.0.6-5.el8_10.x86_64.rpm Thanks Mo
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:90888 https://access.redhat.com/errata/RHSA-2026:90888
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:90891 https://access.redhat.com/errata/RHSA-2026:90891
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:90892 https://access.redhat.com/errata/RHSA-2026:90892
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:90890 https://access.redhat.com/errata/RHSA-2026:90890
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:90914 https://access.redhat.com/errata/RHSA-2026:90914
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:92376 https://access.redhat.com/errata/RHSA-2026:92376
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:92420 https://access.redhat.com/errata/RHSA-2026:92420
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:92428 https://access.redhat.com/errata/RHSA-2026:92428
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:92378 https://access.redhat.com/errata/RHSA-2026:92378
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:92492 https://access.redhat.com/errata/RHSA-2026:92492
This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 2.4 for RHEL 9 Via RHSA-2026:93065 https://access.redhat.com/errata/RHSA-2026:93065