Most vulnerability queues stall on the same question: is this week's CVE a maintenance ticket or an incident. For CVE-2026-111497 the answer depends less on the CVSS number than on a single fact about each service, namely whether it decompresses Brotli data that an outsider controls.
The score and the disagreement around it
The Singapore Cyber Security Agency's alert AL-2026-154 rates the defect 9.8 on CVSS v3.1 and calls it critical. The Node.js project's own security release post labels the same issue high. That is not a contradiction to resolve by picking a favourite number; it is a sign that the vector table rewards a library-level write primitive while maintainers weigh reachability inside real applications.
For a triage decision, treat 9.8 as the ceiling rather than the expectation. The score is accurate for a service that inflates untrusted Brotli input. For a service that never touches Brotli, the practical severity is a maintenance item with a normal change window.
Affected and fixed versions
The affected lines are 22.x, 24.x and 26.x. Fixed releases are 22.23.4, 24.22.1 and 26.12.1. Anything on an end-of-life branch should be treated as permanently affected, because the project does not backport security fixes to unsupported lines.
Two further checks belong in the ticket. First, the CVE record attributes the flaw to Brotli 1.0.3 through 1.2.0 in c/dec/decode.c, fixed in 1.0.10, 1.1.1 and 1.2.1, so a separately vendored Brotli library needs its own patch. Second, container images and prebuilt binaries carry the decoder inside them, so a rebuilt application on an unchanged base image can still ship the vulnerable build.
Reachability: the only question that changes the schedule
Ask three questions of every service in scope.
Does it inflate Brotli input at all? node:zlib exposes the decoder used by Node.js itself, and any code path that accepts br content encoding, decompresses a stored payload, or expands a compressed message is a candidate.
Who supplies that input? A service that only inflates archives produced by its own trusted pipeline moves this issue from incident to maintenance. A service that inflates whatever arrives on a public endpoint moves it the other way.
What else lives in that process? The advisory describes three outcomes: a crash, disclosure of process memory, and remote code execution. The last two are only interesting to an attacker when the process holds secrets, database credentials or signing keys. An isolated decoder with no permissions is a much smaller prize than a monolithic API server.
The rest of the release does not change the answer
The October 21, 2026 release carries nine other CVEs, including DNS name truncation, three TLS hostname verification bypasses, a keep-alive response ordering flaw and several permission model issues. None of them alter the Brotli decision, but they do mean the upgrade should ship as one change rather than a hotfix for a single identifier.
A defensible order of work
Patch internet-facing services that accept compressed input first, and confirm the version from the running process rather than the deployment manifest. Second, patch internal services that decode data crossing a trust boundary, including queue consumers and importers. Third, schedule the remainder in the normal cycle and stop counting end-of-life branches as merely overdue.
If the first group cannot be patched today, add a decompression guard in front of it: a size ceiling on both compressed and expanded data, and a rule that rejects Brotli bodies on endpoints that never asked for them.
The defect was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security and fixed by mcollina and aduh95. The interesting part for a patch board is not that a decoder wrote past a buffer, but that the risk was decided by a routing question nobody had written down.