Introduction

CVE-2026-111497 is an exploit in the Brotli library distributed in the Node.js runtime. Brotli is a compression format, which Node.js supports through the native decoder in its zlib module. The CVE record describes a buffer overflow in c/dec/decode.c and lists two weakness types: out-of-bounds write (CWE-787) and unchecked return value (CWE-252). A crafted Brotli stream sent to an open Node.js endpoint declares one type of data block, then asks the decoder to switch block types. The unpatched decoder ignores the error and keeps going, writing past the end of its buffer.

Environment

Studio Pro (all versions)

Details

Who is affected:

• Users using the PDF Document Generation Module locally
• Debugging for Native Mobile: Metro Dev Server (local run of an app with a native profile, and native debugging)

Exploit Details

CVE-2026-111497 requires open internet access and an active listening port on the Node.js runtime in order to receive the crafted stream, so only components with open web access are potentially vulnerable to this exploit. This means that, for the PDF Document Generation Module, it would need to be locally installed and permissively open to the internet.

For Native Debugging/Metro Dev Server, the application would need to be actively running locally and have port 8083 (the default for Metro) open to external internet traffic, so the main risk is a developer on an untrusted network, or a machine with a permissive firewall. Additionally, the process is short-lived. It exists only while the app is running locally for debugging, which narrows the window.

What Mendix has done:

Mendix is in the process of adjusting the PDF Document Generation Module to disable elements of Axios in the module, so never decompress Brotli from untrusted callback URLs. As of 4 November 2026, this fix is still in the implementation process.

Mendix is in the process of backporting an upgrade to bundled Node in Studio Pro to LTS/MTS versions. The latest version of Studio Pro has the upgraded Node versions. As of 4 November 2026, backporting is still in progress.

Mendix is continuing to monitor the situation and investigate the code base for any additional points of vulnerability, and will update this article if or when any new issues are discovered.

Actions Required To Apply Fix

At this time, no user-side action is required. Please monitor this bulletin for any additional information and updates on Mendix's ongoing efforts to safeguard against the exploit in the PDF Document Generation module and MxBuild.

Other Mendix Components using Node.js that are unaffected

The following implementations of Node.js are local only and cannot receive the necessary compression stream:

• Start from Spreadsheet (snapshot creator)
• MxBuild
• Native mobile: bundling (build/export)
• Web app bundling in Studio Pro (Run locally)
• CSS / SCSS / JavaScript language servers (inline editors)

Additional information

Mendix documentation: 

• PDF Document Generation Module 
• Debugging for Native Mobile

Other documentation:

• CVE-2026-111497
• What is Node2Shell?