TL;DR

Brotli is Google's compression format, and a decoder is the code that turns a compressed br stream back into plain bytes; Node.js ships one inside node:zlib so applications can decompress responses and request bodies without an extra dependency.

The upstream Brotli patch and vulnerable decoder source show how CVE-2026-111497 became an out-of-bounds write: an invalid block switch returned the temporary-input status, so streaming continued through an eight-byte internal buffer and wrote past its end.

The CVE record places the flaw in Google Brotli 1.0.3 through 1.2.0 and names Brotli 1.2.1 as a fixed version; the Node.js advisory lists 26.x, 24.x and 22.x as affected and provides builds 26.12.1, 24.22.1 and 22.23.4.

The CVE record describes crafted Brotli data from a remote unauthenticated attacker; OX Security's Node.js analysis traces untrusted data to the bundled decoder through node:zlib , so a request body and a fetched response both arrive at the same code.

The CVE record scores it 9.2 under…