A critical vulnerability, CVE-2026-111497, has been identified in the Google Brotli compression library. The vulnerability affects the Brotli decoder and may allow a remote, unauthenticated attacker to trigger memory corruption via a specially crafted Brotli-compressed stream. Successful exploitation could result in memory disclosure, denial of service (DoS), or arbitrary code execution in affected implementations. Recent vendor guidance from Node.js specifically identifies remote code execution as a possible outcome in impacted Node.js environments.
The vulnerability is caused by an out-of-bounds write in the Brotli decoder's block-type switch handling within c/dec/decode.c. Exploitation occurs when an application processes attacker-controlled Brotli-compressed data.
Because Brotli is commonly used across modern web applications, web servers, APIs, proxies, CDNs, and software frameworks, the potential impact extends beyond applications directly using the Brotli library. Several vendors have already published advisories and begun releasing updates for affected products.
Organisations should not dismiss this vulnerability as impacting only niche deployments. Brotli compression has become a common component of modern web infrastructure and is frequently embedded within application frameworks, APIs, reverse proxies, content delivery services, and software runtimes. Many organisations may therefore be affected indirectly through bundled dependencies rather than direct use of the Brotli library itself.
As of 28 October 2026, public reporting identifies in-the-wild exploitation and a reported CISA KEV addition on 27 October, although direct confirmation of the catalogue entry was unavailable during this review. Public memory-corruption/DoS PoCs and RCE claims exist, but a reliable, independently verified public RCE exploit has not been established by the sources reviewed. However, the vulnerability remains significant due to its network-accessible attack surface and the widespread adoption of Brotli compression.
Affected Components
Technical Details
CVE-2026-111497 is an out-of-bounds write vulnerability affecting the Google Brotli decoder. The flaw exists within the decoder's handling of block-type switching logic and may be triggered by processing a crafted Brotli-compressed stream.
Successful exploitation may allow an attacker to:
Exploitation requires an application to decompress attacker-controlled Brotli data using a vulnerable decoder; supporting Brotli compression alone does not imply exploitability.
Examples may include:
Severity and Exploitation
The vulnerability is particularly concerning because:
However, available reporting also notes that exploitation requires the target to process attacker-controlled Brotli data. The public syrex1013/node2shell repository describes a memory-corruption/DoS path using a lab addon; its documented RCE paths also rely on separate application command injection or evaluation. These claims do not establish a reliable, independently verified public RCE exploit for the Brotli flaw alone.
Threat Activity
Public reporting dated 28 October 2026 states that CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue on 27 October, citing evidence of active exploitation. Direct confirmation of this entry was unavailable during this review. The scale of in-the-wild exploitation remains unclear.
The vulnerability may attract further targeting by threat actors due to:
Organisations should assume vulnerable internet-accessible systems processing Brotli-compressed content may be targeted following public disclosure.
What This Means for Organisations
Organisations should identify applications, services, and infrastructure components that utilize Brotli decompression functionality, either directly or through bundled libraries.
Unlike vulnerabilities requiring local access or prior compromise, CVE-2026-111497 may be triggered remotely when a vulnerable application processes malicious Brotli-compressed content. Depending on the affected product and deployment scenario, successful exploitation could result in information disclosure, service disruption, or potentially arbitrary code execution.
Given the prevalence of Brotli within modern web ecosystems, organisations should not assume only explicitly Brotli-enabled applications are affected. Dependencies and bundled libraries should also be reviewed.
Apply Vendor Updates
Inventory Dependencies
Review Internet-Accessible Services
Monitor for Anomalous Behavior
Follow Vendor Advisories
Risk Summary
CVE-2026-111497 is a critical memory corruption vulnerability affecting the Google Brotli decoder. The flaw can be triggered remotely through specially crafted Brotli-compressed content and may lead to memory disclosure, denial of service, or potentially arbitrary code execution.
Although the scale of reported active exploitation remains unclear and a reliable, independently verified public RCE exploit has not been established by the sources reviewed, the widespread use of Brotli compression across web applications and services significantly increases the potential exposure of affected environments. Organisations should identify impacted systems and apply vendor-recommended updates as a priority.
If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively get in touch to find out how you can protect your organisation.