Fedora Account System
Red Hat Associate
Red Hat Customer
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
RHEL 8 `nodejs:24` bundles Brotli 1.2.0 in `libnode.so` (`bundled(brotli) = 1.2.0`, no link to the system `libbrotli`), which is inside the 1.0.3–1.2.0 range in this bug's description. The CVE page marks `nodejs:24/nodejs` as Not affected, and there's no nodejs tracker. Please re-evaluate."
Additional detail: Node fixed CVE-2026-111497 in v24.22.1 by cherry-picking google/brotli 0ed4268a4401 into deps/brotli/c/dec/decode.c (nodejs/node commit 49dff6f57aa7) without changing version.h, which still says 1.2.0. nodejs-24.21.0's decode.c is byte-identical to upstream brotli v1.2.0, so it lacks the fix, and the nodejs-24.21.0-1.module+el8.10.0+24927 sources carry no brotli patch. The AlmaLinux rebuild's libnode.so uses the bundled decoder rather than the system libbrotli. The decoder is reachable through zlib.brotliDecompress / createBrotliDecompress and through fetch() with Content-Encoding: br, which this CVE's statement itself names. Please re-check nodejs:24 on RHEL 8.