Node.js Brotli decoder vulnerability, CVE-2026-111497, and VMware by Broadcom product portfolio

Products

• VMware Cloud Foundation
• VMware Cloud Director
• VMware HCX
• VMware Workstation
• VMware Telco Cloud Platform
• VMware Fusion

Issue/Introduction

Node.js Brotli decoder contains a critical, remote code-execution vulnerability due to an out-bounds write issue

Environment

• VMware Cloud Foundation (VCF) and VMware vSphere Foundation (VVF) components and add-ons, versions 5.2.x and 9.x. See the VCF 5.2.4 BOM and VCF 9.1.1 BOM for a list of components
• VMware Cloud Director
• VMware Remote Console
• HCX
• PowerCLI
• VMware Telco Cloud Platform
• VMware Workstation
• VMware Fusion

 

Cause

Node.js Brotli decoder contains a critical, remote code-execution vulnerability due to an out-bounds write issue

Resolution

VMware by Broadcom products have been reviewed for CVE-2026-111497 and none of its products are critically affected except the SDDC Manager in VCF 9.1.1

VMware Security Advisory VMSA-2026-0008 documents remediation for SDDC Manager.