Security

Brotli CVE-2026-111497: a decompression bug in a library you did not know you shipped

28 October 2026·9 min read

Some of the most important libraries in your estate are ones nobody chose. Brotli is a compression format used to shrink web content, and its decoder is bundled into runtimes, browsers, proxies and language packages. On 21 October a flaw in that decoder was fixed. On 27 October CISA added it to its list of exploited vulnerabilities. This note is about how little you may know about where it lives.

It is for you if you run Node.js services, any software that decodes Brotli, or the build and image pipeline that decides what ships. Everything is as of 28 October 2026 and every claim links to its source at the end.

The short version

CVE-2026-111497 is a buffer overflow in the Brotli decoder (CWE-787, out-of-bounds write; CWE-252, unchecked return value). A remote unauthenticated attacker who can get a crafted Brotli stream decoded can corrupt memory next to the decoder's state, disclose memory contents, crash the process or potentially execute code.
CVSS 4.0 9.2, with attack requirements Present. The record credits OpenAI Codex Security (Khai Tran) and Sylvie Mayer.
Affected: Google Brotli 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1. Brotli 1.2.1 was released on 21 October.
Node.js: the 21 October security release fixes it in the 26.x, 24.x and 22.x lines; the release lists v26.12.1, v24.22.1 and v22.23.4. The release notes are the place to confirm the mapping for your line.
CISA added it to the Known Exploited Vulnerabilities catalog on 27 October, due 10 November. Ransomware use is not recorded.

Cover page of Brotli decoder overflow: Assessment & Action Plan

Free PDF · 8 pagesBrotli decoder overflow: Assessment & Action PlanThe full version as a PDF for whoever owns your build and runtime estate: the mechanism, severity decoded, fixed versions for the library and for Node.js, a dated timeline, where Brotli hides, exposure by situation, how to find it, hunting and a definition of done.Download the PDF →

What the bug is

The Node.js advisory gives the clearest account. The decoder can be given a malformed stream with an invalid block switch. Instead of reporting that as a permanent format error, the decoder reported it as a temporary need for more input. The streaming decoder then kept appending input bytes to an internal buffer that holds eight bytes. It wrote past the end.

The mistake is a familiar one: an error condition treated as a request to try again. Everything after that is a buffer that was never meant to grow. The Brotli record's description is broader than Node's: it mentions corrupting adjacent decoder state, disclosing memory and potentially running code.

Why this one is hard to scope

Most flaws live in a product you can name. This one lives in a decoder that many products include. Where it hides:

Node.js itself, through node:zlib. The advisory says an application that decompresses Brotli data an attacker supplies is exposed.
System libraries on Linux, which many tools link to.
Language packages for Python, Go and others. The record points to a Go implementation's release (andybalholm/brotli v1.2.7) as part of its references.
Software that bundles its own copy: browsers, HTTP clients, proxies, application servers. A bundled copy does not update when your operating system does.
Container images, where the library sits in a layer that was built months ago.

An HTTP response with a Brotli content-encoding is the obvious way compressed data reaches a decoder, but not the only one. Anything that decompresses Brotli files, API payloads or uploads is a path.

Things people will get wrong

"We do not use Brotli." You may not choose it, but your proxy, your runtime or your client may decode it by default.
"Our operating system is updated." A bundled or statically linked copy is not touched by that.
"It is a Node.js issue." It is a Brotli issue that Node.js is one carrier of. The Node.js release is the one with the clearest advisory.
"CVSS 4.0 9.2 and an attack requirement, so it is hard." Attack requirements Present means a condition must hold, not that the condition is rare. Decompressing data you do not control is a normal thing for a service to do.

The same Node.js release fixes more

If you upgrade Node.js for this, you pick up nine other fixes from the same release, including two TLS hostname-checking bypasses rated High (CVE-2026-105483 and CVE-2026-106069), a dns.resolve truncation issue (CVE-2026-105482), and several Medium and Low issues in the permission model, UUID generation and zip handling. That is a reason to upgrade the whole runtime and not hunt for a patch to one library.

How we would triage it

This is our judgement from the sources.

Services that decode Brotli from outside your control come first. If you do not know whether a service does, find out; the answer decides the priority.
Node.js is the cleanest fix because there is a dated release. Upgrade it everywhere you can.
For bundled copies, the work is inventory. You cannot patch what you cannot list. Treat this week as the exercise that produces an SBOM you can query.

Step 1: find where Brotli lives

# Node.js versions in use
node --version

# Shared library on a host, and what links to it
ldconfig -p | grep -i brotli
find / -name 'libbrotli*' -not -path '/proc/*' 2>/dev/null

# Python and Go dependencies
pip list 2>/dev/null | grep -i brotli
grep -rn 'andybalholm/brotli' --include=go.mod --include=go.sum .

# Container images: look inside, not at the Dockerfile
docker run --rm --entrypoint sh IMAGE -c 'node --version; find / -name "libbrotli*" 2>/dev/null'

Add anything your software bill of materials lists that mentions Brotli. If you have none, this is the week to start one.

Step 2: upgrade

Node.js: 26.12.1, 24.22.1 or 22.23.4 or later for your line. Rebuild images and redeploy.
Brotli libraries: 1.0.10, 1.1.1 or 1.2.1 or later.
Bundled copies: check the vendor's release notes and update the product. Where there is no fix, record the owner and the date you will ask again.

If you cannot upgrade this week

Do not decompress untrusted Brotli data with unpatched code. The Node.js advisory lists no other mitigation, and this is our suggestion, not Node's.
Limit which services can reach untrusted compressed input, and run them with the least privilege you can.
Where a proxy or gateway decodes Brotli on your behalf, find out and treat it as in scope.

What to look for

Crashes in services that decode compressed data, especially clusters of them, shortly after requests with a Brotli content-encoding.
Unexpected child processes or outbound connections from services that decompress external data.
Brotli-encoded request bodies arriving at endpoints that do not normally receive them.

What we do not know yet

How it is being exploited, or by whom. The listing does not say.
Whether public exploit code appears. We have not read any.
Which products bundle an affected Brotli and when each ships a fix.

If you take one thing from this: a library does not need to be on your architecture diagram to be in your attack surface. The question to answer this week is not "are we patched" but "where is it".