Reproducing the Node.js Brotli RCE with GLM-5.3 and DeepSeek V4.1 Flash
The author spent $26.80 in tokens using both models to build a PoC for CVE-2026-111497 across 84 builds, noting 58.3% of 14,877 exploit attempts crashed the lab.
The Brotli RCE in Node.js is brutal! CVE-2026-111497 affects all three supported major lines: 22.0.0-22.23.3, 24.0.0-24.22.0, and 26.0.0-26.12.0. One sleepless night with GLM-5.3 and DeepSeek V4.1 Flash 1017, plus $26.80 in tokens, and I had a reliable PoC across those versions on Linux arm64 and x86_64 with ASLR and UV_THREADPOOL_SIZE independent vectors for all 84 builds. But I wouldn't call it suitable for blind black-box testing. I ran 14,877 fresh exploit attempts - every ARM target against every ARM and x86 profile, each in a fresh lab. Wrong profiles are destructive: 58.3% crashed the lab (56.4% ARM profiles, 60.2% x86 profiles replayed on ARM). And HTTP-only fingerprinting was useless: all 87 builds returned byte-identical responses, so you cannot safely guess the profile without force/out-of-band info. Bug bounty hunters, please do not spray profiles at production :) Nine years ago, when I started my career as a Node.js SWE, I never imagined that an ordinary body-parser setup on a Node.js runtime could become an RCE entry point. 2026 keeps surprising me. And it's making me look at attack surfaces differently... Huge respect to the researchers who found this bug