Brotli CVE-2026-111497 Added to CISA KEV: Patch Every Copy

CISA added Brotli CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, and set a November 10 deadline for federal agencies. The flaw is an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0. Node.js, Bun, Envoy, Istio, .NET and the Python Brotli packages all ship their own copy. Any service that decompresses untrusted Brotli data is exposed. Update every copy, not just the system library, then restart the processes that load it.

What happened

Google and the Node.js project shipped fixes on October 21, 2026. Google released Brotli 1.2.1 with a single security note pointing to CVE-2026-111497, and backported the fix to the older lines as 1.0.10 and 1.1.1. Google, acting as the CVE numbering authority, published the record on October 22 with a CVSS 4.0 score of 9.2 (Critical) and weaknesses CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value).

The bug was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security. Node.js fixed it in releases 22.23.4, 24.22.1 and 26.12.1 the same day.

On October 27, CISA listed the flaw in the KEV catalog under the name "Google Brotli Unchecked Return Value Vulnerability". A KEV listing means CISA has evidence of exploitation. That is a change from CISA's October 23 assessment on the CVE record, which The Hacker News reported as exploitation "none". As of this writing no public report names an attacker, a target or indicators of compromise, and the KEV entry lists ransomware use as "Unknown".

Who is affected by Brotli CVE-2026-111497

Brotli is a compression format used for HTTP responses and request bodies. Most software does not link one shared system copy. It bundles its own decoder, so each product needs its own fix. Patched versions reported by Wiz, The Hacker News and the vendors:

Google Brotli (libbrotli): 1.0.3 through 1.2.0 are affected; fixed in 1.0.10, 1.1.1 and 1.2.1.
Node.js: unpatched 22.x, 24.x and 26.x; fixed in 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end of life and get no fix.
Bun: 1.0.21 through 1.4.3; fixed in 1.4.4.
Envoy Proxy: fixed in 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0. Exposure requires Brotli decompression to be enabled.
Istio: fixed in 1.29.9, 1.30.6 and 1.31.2.
.NET: fixed in 8.0.33, 9.0.22, 10.0.14 and 11.0 RC3.
Python: Brotli fixed in 1.2.1 and brotlicffi in 1.2.1.0. The HTTP clients urllib3 (and therefore requests), aiohttp and httpx with its brotli extra use these packages automatically when they are installed.
Go: the andybalholm/brotli port is fixed in v1.2.7.
Debian: bookworm 1.0.9-2+deb12u1 and trixie 1.1.0-2+deb13u1.

The Hacker News also lists FFmpeg (through libjxl), ClickHouse and the Apache Arrow C++ library as bundling vulnerable Brotli code, with fixes still in progress as of October 26. Git for Windows bundled Brotli 1.2.0 in its curl build until 2.56.0.windows.4. Wiz reports that 91% of the cloud environments it monitors contain at least one vulnerable resource.

Technical analysis

According to the Node.js advisory, malformed compressed input can write past the end of an eight-byte internal decoder buffer. The decoder treated an invalid block switch as a temporary need for more input instead of a permanent format error. A streaming decoder then kept appending bytes to that small buffer. The CVE record lists the outcomes as memory corruption, memory disclosure, denial of service and possible code execution.

The bug works in both directions. A server that decompresses Brotli request bodies can be attacked by a client, and a client that decodes Brotli responses can be attacked by a malicious server. That second case matters for anything that fetches external URLs: webhooks, link previews, scrapers, AI agents and package tooling.

Vendors disagree on the worst case. Google scores it 9.2 and describes remote code execution. Red Hat rates it 8.1 and says there is no reliable public proof of concept for code execution. Microsoft's .NET advisory lists information disclosure, denial of service and elevation of privilege, without remote code execution. Imperva's red team ran attacker-supplied code on an unmodified Node.js 24.22.0 build for Linux on ARM64, but it took several attempts and the exploit has not been released.

For planning, treat it as remotely triggerable memory corruption in a component you probably run in many places, now with CISA's exploitation flag on it.

What to do now

Patch the runtimes first. Upgrade Node.js, Bun, .NET, Envoy and Istio to the fixed releases above, starting with internet-facing services and anything that fetches external content.
Patch the language packages. Upgrade Python Brotli to 1.2.1 and brotlicffi to 1.2.1.0, regenerate lockfiles and rebuild container images. A package can be present without your code importing it. Our guide on how to find vulnerable Brotli copies on your systems covers the version checks for each ecosystem.
Restart and redeploy. Running processes keep the old decoder in memory until they restart. Rebuild base images rather than patching running containers.
Use interim controls where you cannot patch. Reject requests with Content-Encoding: br at the edge before any proxy or parser decodes them, and turn off automatic Brotli decoding in HTTP clients. Removing br from Accept-Encoding does not help, because a hostile server can send Brotli anyway. Node.js has published no workaround, so for Node the only fix is the upgrade. Cloudflare added two managed WAF rules, but they only log by default.
Watch for crashes. Unexpected segfaults or restarts in Node.js, Envoy or Python workers that handle compressed traffic are worth a look, along with WAF and proxy logs showing Brotli-encoded requests to services that do not expect them.

If Brotli is new to you, start with what Brotli compression is and where it runs. The harder long-term problem is that every bundled copy needs its own patch, which we cover in why patching bundled libraries takes more than one update.

What to watch next

Exploitation details from CISA or a vendor: which products were targeted and whether servers or clients were hit.
Fixes for FFmpeg, ClickHouse, Apache Arrow and distribution packages that were still pending on October 26, including Ubuntu's brotli and nodejs packages and Node.js 22 on SUSE Linux Enterprise 15.
Appliances and commercial software that statically link Brotli. Their vendors may take weeks to publish advisories, so check your critical suppliers directly.