Table of contents
16
Read this in 30 seconds: CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decompression library. It lets a crafted compressed stream corrupt memory in any program that decompresses attacker-controlled Brotli data, and researchers have turned it into remote code execution on stock Node.js. CISA added it to the Known Exploited Vulnerabilities catalog on 27 October 2026 with a due date of 10 November.
- It is a library bug, but the blast radius is wide. Google fixed it in Brotli 1.0.10, 1.1.1 and 1.2.1 on 21 October, and Node.js, Bun, Envoy, Istio and the Python and Go packages all shipped their own fixes.
- Three scorers disagree. Google rates it 9.2 under CVSS 4.0, NVD rates it 9.8 under CVSS 3.1, and Microsoft rates its .NET exposure 8.1.
- Exploitation is real, but the attacker is unknown. ELLIO reported exploit traffic against its sensors on 26 October, a public exploit exists, and CISA lists ransomware use as unknown.
- You are not exposed just because Brotli is installed. The bug only matters where an application decompresses Brotli data an attacker can supply.
- The fix is a version bump, but check the right version. Node.js 22.23.4, 24.22.1 or 26.12.1, and restart every process after you update.
The lesson of CVE-2026-111497 is that a compression library is part of your attack surface. Brotli sits quietly inside runtimes, proxies and HTTP clients. Most teams never chose it, and most could not say where it runs.
This article covers what the flaw is, how it works at the level the vendors have published, what we know and do not know about exploitation, who is exposed, the fixed versions, and how to check your own systems. It does not include exploit code or payloads.
Brotli is a compression format created by Google. Web servers and browsers use it to shrink pages and scripts, and the format is common in HTTP as Content-Encoding: br. The reference decoder is a small C library, and many projects bundle or link it.
That is why CVE-2026-111497 reaches so far. A decoder has to read data from outside the program and turn it into bytes in memory, which is exactly the situation where a boundary mistake becomes a security bug. Any program that decompresses Brotli data it did not produce is a potential target.
Two directions matter. A server can decompress what clients send it, such as a request body. A client can decompress what servers send it, such as a response from a third-party API. The risk applies to both.
Brotli is also embedded deep. The Node.js node:zlib module bundles it, Bun includes it, Envoy and Istio offer Brotli decompression filters, and Python and Go have their own wrappers. Wiz’s telemetry says 91% of the cloud environments it sees contain a vulnerable resource, though that is a vendor figure we have not verified.
The Node.js project’s advisory describes CVE-2026-111497 as a flaw in the Brotli decoder bundled with Node.js, in which malformed compressed input writes past the end of an internal decoder buffer. The NVD entry, published on 22 October 2026, describes a buffer overflow in c/dec/decode.c in Google Brotli 1.0.3 through 1.2.0 that a remote unauthenticated attacker can use to corrupt adjacent decoder state, disclose memory, crash the process or potentially execute arbitrary code.
Here are the facts, and who said them.
The score depends on who you ask, which matters if your patching policy is score-driven.
| Source | Scoring | Score | Notable difference |
|---|---|---|---|
| Google (CNA) | CVSS 4.0 | 9.2 Critical | Attack requirements marked present |
| NVD | CVSS 3.1 | 9.8 Critical | Attack complexity low, no user interaction |
| Microsoft (.NET) | CVSS 3.1 | 8.1 High | Attack complexity high, and exposure is not default |
The Node.js advisory rates it high rather than critical for Node.js itself. Treat the spread as a sign that real-world risk depends on how your software uses Brotli, not as a reason to wait.
We are describing this at the level the vendors have published. We are not reproducing an exploit.
The Brotli format splits compressed data into blocks, and the stream can declare a switch from one block type to another. According to the Node.js advisory, an invalid block switch was reported to the caller as a temporary need for more input, instead of a permanent format error. The streaming decoder therefore kept accepting input and kept appending the bytes to an eight-byte internal buffer, and writes could land past the end of it.
In plain terms, the decoder answered “this stream is broken” with “send me more data,” and the caller, behaving correctly, did.
The security firm ELLIO describes the upstream fix as a commit titled “Detect and report invalid stream earlier,” and says it gives the helper function a proper error code, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (value -17), so an invalid switch stops decoding. That matches the weakness classification: the unchecked return value (CWE-252) is the cause, and the out-of-bounds write (CWE-787) is the consequence. Google’s release notes for 1.0.10, 1.1.1 and 1.2.1 state only that an out-of-bounds write permits remote code execution.
Why CVE-2026-111497 matters beyond Node.js: the bug is in the C decoder, so every program that links the same code inherits it unless it has been patched.
Yes. The evidence, in order:
node2shell-check reached its sensors first, sending Brotli bodies to find hosts that decompress them. It then reports exploit traffic from a different source, carrying the public exploit code it had confirmed gets a shell on vulnerable builds.What we do not know about CVE-2026-111497 matters just as much. CISA lists known ransomware use as unknown. No public attribution to a named group exists in the sources we read. CISA’s forensic triage flag is “No,” so there is no federal evidence-preservation requirement attached to this one. And the sources do not say how many real compromises have happened, only that exploitation attempts and a working public exploit exist.
Our advice is conservative: treat any internet-facing service that decompresses Brotli data as a target, and keep your logs before you patch if you suspect you were probed.
You are exposed to CVE-2026-111497 when an application decompresses Brotli data that an attacker can influence. Three paths cover most cases.
| Path | Example | What to check |
|---|---|---|
| Incoming request bodies | A server that accepts Content-Encoding: br and decompresses it | Middleware, proxies and framework decompression settings |
| Responses from untrusted servers | A service that fetches third-party URLs and decodes Brotli responses | HTTP client defaults and automatic decompression flags |
| Files and other inputs | Tools that unpack Brotli archives or assets | Any pipeline that ingests user-supplied compressed files |
Microsoft’s advisory for .NET is the clearest example of the “not just because it is installed” rule. It says ASP.NET Core and HttpClient do not decompress Brotli automatically in their default configurations, that exposure requires the application to enable Brotli decompression or call Brotli APIs on attacker-controlled data, and that .NET Framework is not affected.
Patch the Planet, a patch-tracking site, lists Node.js, Bun, and Envoy Proxy and Istio deployments configured for Brotli decompression as affected. For ones you cannot update at once, it says to disable Brotli decoding of untrusted data and keep gzip and deflate.
To fix CVE-2026-111497, update to a fixed version, then restart. The versions below come from the project advisories and the Wiz and Patch the Planet trackers.
| Component | Fixed versions |
|---|---|
| Google Brotli (upstream) | 1.0.10, 1.1.1, 1.2.1 (release notes) |
| Node.js | 22.23.4, 24.22.1, 26.12.1 |
| Bun | 1.4.4 |
| Envoy Proxy | 1.40.0, 1.39.3, 1.38.6, 1.37.8 |
| Istio | 1.29.9, 1.30.6, 1.31.2 |
Python brotli | 1.2.1 |
Python brotlicffi | 1.2.1.0 |
Go andybalholm/brotli | v1.2.7 |
Work through it in this order.
Content-Encoding: br before any middleware decompresses them, turn off automatic Brotli decompression in HTTP clients, and disable the decompressor filter in Envoy and Istio. Turning off Brotli responses on a CDN does not stop request-side or client-side decoding.If you must block request-side Brotli quickly, a reverse proxy rule works while you patch:
# Temporary: reject request bodies compressed with Brotli until runtimes are patched.
if ($http_content_encoding ~* "(^|[,\s])br([,\s]|$)") {
return 415;
}This is a stopgap for CVE-2026-111497. It does not cover response decoding, file processing or internal services.
These commands check for CVE-2026-111497 by listing versions and looking for suspicious behaviour. None of them touches anything outside your own estate.
# Runtime versions (compare with the fixed list above)
node --version
bun --version
envoy --version 2>/dev/null | head -1
# Python wrappers
pip show brotli brotlicffi 2>/dev/null | grep -E '^(Name|Version)'
# Native packages (distros backport, so also read the vendor advisory)
dpkg -l 2>/dev/null | grep -i brotli
rpm -qa 2>/dev/null | grep -i brotli
# Container images that carry Node.js
docker images --format '{{.Repository}}:{{.Tag}}' | while read i; do
v=$(docker run --rm --entrypoint node "$i" --version 2>/dev/null) && echo "$i $v"
done
# Unexpected shell children of Node or Bun processes (Linux)
ps -eo ppid,pid,user,args --forest | grep -E 'node|bun' -A2 | grep -E 'sh -c|/bin/(ba)?sh'
# Restarting workloads in Kubernetes
kubectl get pods -A --sort-by='.status.containerStatuses[0].restartCount' | tail -20Interpret the results carefully. A crash alone proves nothing about CVE-2026-111497, because a malformed Brotli body can also simply crash a vulnerable process. A shell spawned by a web service is a much stronger signal. Look for requests with Content-Encoding: br in access logs, but only if your logging captures that header.
Most vulnerability programmes ask “do we run Brotli?” For CVE-2026-111497 the better question is “which of our services decompress data an outsider can send?”
In an AI-assisted VAPT engagement, that is an attack-surface question. We list which internet-facing services accept compressed request bodies, which of them run a runtime or proxy in the affected range, and which internal services fetch untrusted content. Then we confirm that the patched version is actually the one running. Our cloud infrastructure testing methodology covers the container and Kubernetes side of that check.
Two other things stand out. First, the discoverers are credited to OpenAI Codex Security, which shows AI-assisted vulnerability research is now finding bugs in core runtimes. Second, another late-October runtime bug is PHP2Shell, and the fix path is similar: update, restart and verify.
A pentest report would not certify that you are safe from this CVE. It documents what was tested and found at a point in time, and you should still patch and verify on your own systems.
Yes. CISA added CVE-2026-111497 to its KEV catalog on 27 October 2026, and ELLIO reported exploit traffic against its sensors on 26 October. No public source we read names the attacker, and CISA lists ransomware use as unknown.
Node.js 22.23.4, 24.22.1 and 26.12.1 contain the fix, according to the Wiz and Patch the Planet trackers, and Node.js published its security releases on 21 October 2026. The advisory says the 26.x, 24.x and 22.x lines are affected. Restart your processes after updating.
Possibly. CVE-2026-111497 is in Google’s Brotli decoder, so Bun, Envoy, Istio, the Python brotli and brotlicffi packages and other software that links the library can be affected. Whether you are exposed depends on whether the software decompresses Brotli data that an attacker can supply.
Microsoft says it can. Its advisory scores .NET at 8.1, says .NET Framework is not affected, and says ASP.NET Core and HttpClient do not decompress Brotli by default, so you are exposed only if you enabled Brotli decompression or call Brotli APIs on untrusted data.
It depends on the scorer. Google rates it 9.2 Critical under CVSS 4.0 and NVD rates it 9.8 Critical under CVSS 3.1, while Microsoft rates its .NET exposure 8.1 High and the Node.js advisory labels it high. Use the severity for your own deployment and patch internet-facing services first.
Check the runtime and package versions against the fixed list, including container images, then confirm the running version after a restart. Distributions backport fixes, so read your vendor’s advisory when the upstream version looks old. The NVD entry lists the affected upstream ranges.
CVE-2026-111497 is a decoder bug with a very wide footprint: a flaw in a compression library that most teams never chose. Exploitation is confirmed and a public exploit exists, so it belongs on this week’s list, with the CISA due date of 10 November as an outer limit.
The next step is concrete. Inventory what decompresses Brotli, update Node.js, Bun, Envoy, Istio and the Python and Go packages to the fixed versions, restart everything, and verify the running version. If you cannot patch yet, stop decoding untrusted Brotli data.
Categories
Related articles
