Tag: CVE-2026-111497

Node’s bundled Brotli decoder takes a hostile input path

Node bundled a Google library with an out-of-bounds write, and version 20 and older will never see the fix.