new file mode 100644
@@ -0,0 +1,71 @@
+From a18ec92752cd05ad5335bfaa5420a258b81f9afc Mon Sep 17 00:00:00 2001
+From: Antoine du Hamel <duhamelantoine1995@gmail.com>
+Date: Mon, 12 Oct 2026 22:42:14 +0200
+Subject: [PATCH] src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH`
+
+Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
+PR-URL: https://github.com/nodejs-private/node-private/pull/1002
+Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
+CVE-ID: CVE-2026-111497
+
+CVE: CVE-2026-111497
+Upstream-Status: Backport [https://github.com/nodejs/node/commit/a18ec92752cd05ad5335bfaa5420a258b81f9afc]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ src/node_zlib.cc | 1 +
+ test/parallel/test-zlib-invalid-input.js | 27 ++++++++++++++++++++++++
+ 2 files changed, 28 insertions(+)
+
+diff --git a/src/node_zlib.cc b/src/node_zlib.cc
+index a537e766..ae5fa3bc 100644
+--- a/src/node_zlib.cc
++++ b/src/node_zlib.cc
+@@ -1455,6 +1455,7 @@ void DefineZlibConstants(Local<Object> target) {
+ NODE_DEFINE_CONSTANT(target, BROTLI_DECODER_ERROR_FORMAT_PADDING_1);
+ NODE_DEFINE_CONSTANT(target, BROTLI_DECODER_ERROR_FORMAT_PADDING_2);
+ NODE_DEFINE_CONSTANT(target, BROTLI_DECODER_ERROR_FORMAT_DISTANCE);
++ NODE_DEFINE_CONSTANT(target, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH);
+ NODE_DEFINE_CONSTANT(target, BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET);
+ NODE_DEFINE_CONSTANT(target, BROTLI_DECODER_ERROR_INVALID_ARGUMENTS);
+ NODE_DEFINE_CONSTANT(target, BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES);
+diff --git a/test/parallel/test-zlib-invalid-input.js b/test/parallel/test-zlib-invalid-input.js
+index 7aa44dfe..1b6252f1 100644
+--- a/test/parallel/test-zlib-invalid-input.js
++++ b/test/parallel/test-zlib-invalid-input.js
+@@ -51,6 +51,33 @@ nonStringInputs.forEach(common.mustCall((input) => {
+ });
+ }, nonStringInputs.length));
+
++{
++ // A block switch is invalid when the stream declares only one block type.
++ const invalidBlockSwitch = Buffer.from(
++ '200010414141fcffff07002228f00b60f7f41f000000',
++ 'hex',
++ );
++ const expectedError = {
++ code: 'ERR__ERROR_FORMAT_BLOCK_SWITCH',
++ errno: zlib.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH,
++ };
++
++ assert.strictEqual(expectedError.errno, -17);
++ assert.throws(
++ () => zlib.brotliDecompressSync(invalidBlockSwitch),
++ expectedError,
++ );
++
++ const brotli = zlib.createBrotliDecompress();
++ brotli.resume();
++ brotli.on('error', common.expectsError(expectedError));
++ brotli.on('end', common.mustNotCall());
++ for (let i = 0; i < invalidBlockSwitch.length; i++) {
++ brotli.write(invalidBlockSwitch.subarray(i, i + 1));
++ }
++ brotli.end();
++}
++
+ unzips.forEach(common.mustCall((uz, i) => {
+ uz.on('error', common.mustCall());
+ uz.on('end', common.mustNotCall());
+--
+2.50.1
+
@@ -29,6 +29,7 @@ SRC_URI = "http://nodejs.org/dist/v${PV}/node-v${PV}.tar.xz \
file://CVE-2026-48617.patch \
file://CVE-2026-48619.patch \
file://CVE-2026-48937.patch \
+ file://CVE-2026-111497.patch \
"
SRC_URI:append:class-target = " \
file://0001-Using-native-binaries.patch \
Pick patch from [1] also mentioned at Debian tracker in [2] [1] https://github.com/nodejs/node/commit/a18ec92752cd05ad5335bfaa5420a258b81f9afc [2] https://security-tracker.debian.org/tracker/CVE-2026-111497 Note: This patch is required brotli_1.1.1 version on build time. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> --- .../nodejs/nodejs/CVE-2026-111497.patch | 71 +++++++++++++++++++ .../recipes-devtools/nodejs/nodejs_20.20.2.bb | 1 + 2 files changed, 72 insertions(+) create mode 100644 meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-111497.patch