A critical flaw in Google’s Brotli decompression library, tracked as CVE-2026-111497, is now being exploited. CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026. Because Brotli is built into Node.js and many web servers, proxies and language libraries, a malicious compressed request can crash a service and, in some cases, run attacker code.
What happened
The bug sits in Brotli’s decoder. Per Cyber Security News, a helper function returned the same value for an invalid block switch and for running out of input, so bad data never drained an eight-byte buffer and writes eventually spilled past it. CISA calls it an unchecked return value problem; the NVD classifies it as an out-of-bounds write. A remote, unauthenticated attacker can send a crafted Brotli stream to corrupt memory, leak data or crash the process. Google’s CNA scored it 9.2 under CVSS 4.0, according to Cyber Security News.
Node.js and Google released fixes on October 21, and Imperva demonstrated a working exploit against an official Node.js image the next day. Researchers at ELLIO recorded a large exploit request on October 26 and scanners probing for hosts that accept Brotli, which looks like target-list building. ELLIO reported its test of that exploit crashed a clean vulnerable target rather than producing a shell, so reliable mass compromise is not confirmed. CISA has not said who is attacking or which products are being hit, and lists ransomware use as unknown. Federal agencies have until November 10, 2026 to remediate.
Who is affected
Brotli versions 1.0.3 through 1.2.0 are vulnerable, per CIS as cited by Cyber Security News; fixed library releases are 1.0.10, 1.1.1 and 1.2.1. Affected Node.js lines are 22.x, 24.x and 26.x, plus end-of-life 20.x, 23.x and 25.x that will not get a fix. Patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1. Other reported affected software includes Bun before 1.4.4, the Python brotli and brotlicffi packages, Envoy, the Ruby brotli gem and many Linux distributions. BleepingComputer adds that Microsoft issued an emergency .NET update, and that Palo Alto Networks was still rolling out PAN-OS hotfixes at publication.
What to do
- Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, and update Bun, Python packages, Envoy and distribution Brotli packages. Check the Node.js release number, not
process.versions.brotli: Node.js backported the fix without changing that string, so it reports 1.2.0 on patched and unpatched builds. - Rebuild container images, refresh lockfiles and restart processes. Dockerfiles pinned to Node.js 24.22.0 keep shipping the vulnerable build until edited, and bundled copies (for example in compiled Bun executables) need separate updates.
- If you cannot patch immediately, block or disable Brotli-encoded requests at the proxy or firewall (
Content-Encoding: br), as the sources recommend. - Our analysis: replace end-of-life Node.js 20, 23 and 25 deployments, since they will not receive this fix, and check logs for large Brotli POST bodies or repeated worker crashes. Cyber Security News also notes failed attempts can leave core dumps that may hold session tokens or keys, so restrict access to them.
What we still do not know
CISA has not published who is exploiting the flaw or which targets were compromised, and the original discoverer is not named in the reports we reviewed. Observed activity so far is scanning and a small number of exploit attempts, so the scale of real-world breaches is unclear. The full list of affected vendors and fixed versions is still growing, so check your own vendors’ advisories.
Sources: BleepingComputer, Oct. 28, 2026; Cyber Security News, Oct. 28, 2026; SQ Magazine, Oct. 28, 2026.
Leave a Reply