A critical vulnerability, CVE-2026-111497, has been identified in the Google Brotli compression library. The vulnerability affects the Brotli decoder and may allow a remote, unauthenticated attacker to trigger memory corruption via a specially crafted Brotli-compressed stream. Successful exploitation could result in memory disclosure, denial of service (DoS), or arbitrary code execution in affected implementations. Recent vendor guidance from Node.js specifically identifies remote code execution as a possible outcome in impacted Node.js environments.

The vulnerability is caused by an out-of-bounds write in the Brotli decoder's block-type switch handling within c/dec/decode.c. Exploitation occurs when an application processes attacker-controlled Brotli-compressed data.

Because Brotli is commonly used across modern web applications, web servers, APIs, proxies, CDNs, and software frameworks, the potential impact extends beyond applications directly using the Brotli library. Several vendors have already published advisories and begun releasing updates for affected products.

Organisations should not dismiss this vulnerability as impacting only niche deployments. Brotli compression has become a common component of modern web infrastructure and is frequently embedded within application frameworks, APIs, reverse proxies, content delivery services, and software runtimes. Many organisations may therefore be affected indirectly through bundled dependencies rather than direct use of the Brotli library itself.

As of 28 October 2026, public reporting identifies in-the-wild exploitation and a reported CISA KEV addition on 27 October, although direct confirmation of the catalogue entry was unavailable during this review. Public memory-corruption/DoS PoCs and RCE claims exist, but a reliable, independently verified public RCE exploit has not been established by the sources reviewed. However, the vulnerability remains significant due to its network-accessible attack surface and the widespread adoption of Brotli compression.

Affected Components

  • Product: Google Brotli
  • Component: Brotli Decoder (c/dec/decode.c)
  • Affected Versions:
    • Brotli 1.0.3–1.0.9, 1.1.0, and 1.2.0 (excluding the patched releases listed below)
  • Fixed Versions:
    • 1.0.10
    • 1.1.1
    • 1.2.1
  • Potentially affected software may include:
  • Web servers supporting Brotli decompression
  • Reverse proxies and gateways
  • API services processing Brotli content
  • Node.js applications utilizing vulnerable Brotli decoders: supported release lines 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1; update to these fixed releases or later patched releases in the same line
  • Microsoft .NET applications decoding untrusted Brotli data; Microsoft lists fixes in .NET 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3.26522.148 for affected packages
  • Applications and libraries that automatically decompress Brotli content received from untrusted sources
 

Technical Details

CVE-2026-111497 is an out-of-bounds write vulnerability affecting the Google Brotli decoder. The flaw exists within the decoder's handling of block-type switching logic and may be triggered by processing a crafted Brotli-compressed stream.

Successful exploitation may allow an attacker to:

  • Corrupt adjacent memory
  • Disclose sensitive memory contents
  • Cause application crashes or service disruption
  • Potentially achieve arbitrary code execution under certain circumstances

Exploitation requires an application to decompress attacker-controlled Brotli data using a vulnerable decoder; supporting Brotli compression alone does not imply exploitability.

Examples may include:

  • HTTP traffic utilising Content-Encoding: br
  • API requests or responses containing Brotli-compressed content
  • Applications using Brotli decompression libraries directly
  • Frameworks that automatically process Brotli-compressed input

Severity and Exploitation

  • CVSS Score: 9.2 (Critical) – CVSS v4.0 (Google/CNA); Node.js classifies the issue as High. Red Hat separately rates it Important, with a CVSS v3.1 score of 8.1 (High)
  • Attack Vector: Network
  • Privileges Required: None
  • User Interaction: None

The vulnerability is particularly concerning because:

  • Exploitation can be performed remotely over the network
  • No authentication is required
  • No user interaction is required
  • Memory corruption vulnerabilities can be difficult to detect
  • Brotli compression is widely deployed across modern applications and services
  • Node.js has publicly described the vulnerability as permitting remote code execution in affected environments

However, available reporting also notes that exploitation requires the target to process attacker-controlled Brotli data. The public syrex1013/node2shell repository describes a memory-corruption/DoS path using a lab addon; its documented RCE paths also rely on separate application command injection or evaluation. These claims do not establish a reliable, independently verified public RCE exploit for the Brotli flaw alone.

Threat Activity

Public reporting dated 28 October 2026 states that CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue on 27 October, citing evidence of active exploitation. Direct confirmation of this entry was unavailable during this review. The scale of in-the-wild exploitation remains unclear.

The vulnerability may attract further targeting by threat actors due to:

  • Its critical severity rating
  • Widespread deployment of Brotli-enabled applications
  • Remote attack surface
  • Potential memory disclosure and code execution impacts

Organisations should assume vulnerable internet-accessible systems processing Brotli-compressed content may be targeted following public disclosure.

What This Means for Organisations

Organisations should identify applications, services, and infrastructure components that utilize Brotli decompression functionality, either directly or through bundled libraries.

Unlike vulnerabilities requiring local access or prior compromise, CVE-2026-111497 may be triggered remotely when a vulnerable application processes malicious Brotli-compressed content. Depending on the affected product and deployment scenario, successful exploitation could result in information disclosure, service disruption, or potentially arbitrary code execution.

Given the prevalence of Brotli within modern web ecosystems, organisations should not assume only explicitly Brotli-enabled applications are affected. Dependencies and bundled libraries should also be reviewed.

Recommended Mitigation Steps

 

Apply Vendor Updates

  • Identify products utilizing Brotli decompression functionality
  • Upgrade vulnerable Brotli libraries to vendor-recommended fixed versions, including vendor-backported system packages where applicable
  • Prioritize internet-facing applications and services, and clients that decode untrusted Brotli responses
  • Apply vendor patches as they become available for affected products

Inventory Dependencies

  • Review software bill of materials (SBOM) data where available
  • Identify direct and indirect dependencies utilising Brotli
  • Review bundled Brotli libraries within third-party applications

Review Internet-Accessible Services

  • Identify applications that process Brotli-compressed content
  • Review exposed API endpoints
  • Assess reverse proxies and web gateways supporting Brotli decompression

Monitor for Anomalous Behavior

  • Investigate unexpected application crashes
  • Review logs for malformed Brotli requests
  • Monitor for service instability following processing of compressed content

Follow Vendor Advisories

  • Review security advisories from application vendors
  • Track updates for software products incorporating Brotli
  • Verify remediation status across managed assets

Risk Summary

CVE-2026-111497 is a critical memory corruption vulnerability affecting the Google Brotli decoder. The flaw can be triggered remotely through specially crafted Brotli-compressed content and may lead to memory disclosure, denial of service, or potentially arbitrary code execution.

Although the scale of reported active exploitation remains unclear and a reliable, independently verified public RCE exploit has not been established by the sources reviewed, the widespread use of Brotli compression across web applications and services significantly increases the potential exposure of affected environments. Organisations should identify impacted systems and apply vendor-recommended updates as a priority.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively get in touch to find out how you can protect your organisation.

 

Contact Us