Node.js Brotli Decoder on SAP BTP: CVE-2026-111497 · CVSS 3.0 9.8 · SAP Note 3843368
SAP published Note 3843368 between patch days, on 28 October, with an update on 29 October. It covers an out-of-bounds write in the native Brotli decoder, versions 1.0.3 to 1.2.0. Node.js exposes the decoder through its node:zlib module. When an app decompresses attacker-controlled bytes, the decoder corrupts memory. For example, a request with Content-Encoding: br handled by body-parser can trigger it. SAP rates the Node.js Brotli Decoder on SAP BTP issue at CVSS 9.8, HotNews. In this post, we cover exposure, the fix and what to check.
Node.js Brotli Decoder on SAP BTP: patched versions
For the Node.js Brotli Decoder on SAP BTP issue, use Node.js 22.23.4, 24.22.1 or 26.12.1 and later, or Bun 1.4.4 or later. The fixed native Brotli versions are 1.0.10, 1.1.1 and 1.2.1. In addition, the same library ships in the Python brotli and brotlicffi packages and in other runtimes on BTP. So this is not only a Node.js problem.
Cloud Foundry and Kyma
Node.js buildpack 1.9.6 (22 October) has the fix. However, apps only pick it up after cf restage, so restage every Node.js app. Docker and Kyma workloads, in contrast, need rebuilt images and a rollout to close this issue. FAQ: 3844605.
Workaround
Rejecting inbound requests with Content-Encoding: br before decompression closes the main HTTP path. However, it does not protect outbound responses, direct decoder calls or file processing. Therefore, treat it as a stopgap for the Node.js Brotli Decoder on SAP BTP issue, and remove it once you patch the runtime.
What to check
First, list every Node.js and Python app across your subaccounts. Next, check the runtime and Brotli library versions each one actually runs. Finally, restage or redeploy anything older, because the Node.js Brotli Decoder on SAP BTP fix only works once it reaches the running app.
Node.js Brotli Decoder on SAP BTP: advisory details
Component: BC-CP-SEC-VUL
SAP priority: HotNews
First release: 28.10.2026
Reviewed release: 29 October 2026, note version 9
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: SAP Security Note 3843368 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
