Node.js credits Codex Security for a Brotli memory-safety finding

CLM-NODE-BROTLI-111497-1 reports: CVE-2026-111497 affects Node.js 26.x, 24.x and 22.x. The October 21 release set lists versions 26.12.1, 24.22.1 and 22.23.4. Source SRC-2026-CP17-NODE-OCT21 is located at 'Node.js Brotli decoder out-of-bounds write; Downloads and release details'. The distinctive mechanism begins: The Node.js October security notice identifies an out-of-bounds write in Brotli decompression with potential remote code execution, and credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer alongside the named fix authors. Classification: setting=research_demonstration, exploit_status=not_established, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=patch_available; scoped control or limit: Upgrade affected Node.js major versions to the October 21 fixed releases; treat advisory severity as a warning of possible impact, not evidence that a remote exploit was observed. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.

Assessed Oct 23, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-NODE-BROTLI-111497-1 · Node.js: October 21 security releases