Out-of-bounds Write in Elastic Agent Leading to Remote Code Execution
Out-of-bounds Write (CWE-787) in the Brotli decoder of Node.js, a dependency of Elastic Agent (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to cause a crash, disclose process memory, or potentially execute code within the Node.js process that runs Synthetics browser monitors via a specially crafted, malformed compressed response. Exploitation requires an attacker who controls an endpoint that a journey requests, or who has compromised an upstream service, to return a response that triggers the known vulnerability CVE-2026-111497. If code execution succeeds, the attacker gains the same access to files, credentials, and network resources as the affected Synthetics process. The Elastic Agent Docker images that support Synthetics browser monitors bundle Node.js as the Synthetics monitoring runtime.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.23
- 9.x:
- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5
Affected Configurations:
- Elastic Agent Docker images that run Synthetics browser monitors, including Synthetics Private Locations, whose journeys make Node-side HTTP requests, such as requests through the Playwright request API.
- Exploitation requires the response to be decoded by the Node-side client. Ordinary browser navigation alone does not establish this path.
- Elastic Agent deployments that do not run Synthetics browser monitors are not affected.
Solutions and Mitigations:
The issue is resolved in version 8.19.24, 9.4.9, and 9.5.6. The Elastic Agent Docker images for these versions bundle Node.js 22.23.4, which contains the upstream fix.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: High ( 8.1 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID: CVE-2026-111497
Problem Type: CWE-787 - Out-of-bounds Write