Brotli's Decoder Bug Was Fixed in February and Disclosed in October, and CISA Now Lists It

A remote, unauthenticated attacker who can get a vulnerable application to decompress a crafted Brotli stream can corrupt memory in that process, and in some cases run code. The flaw is CVE-2026-111497, an out-of-bounds write in the Brotli decoder, and CISA added it to the Known Exploited Vulnerabilities catalog on Oct. 27 with a Nov. 10 due date for federal agencies. The precondition matters: the application, or a library it uses, has to decompress data the attacker controls.

The fix is older than the advisory. Help Net Security reports that the correction was committed to google/brotli on Feb. 27, 2026, with no release and no security advisory, and that it stayed publicly readable for eight months. Node.js disclosed the flaw on Oct. 21 as part of a release that fixed ten vulnerabilities, according to The Register.

Who found it, and who proved it works

The Wiz write-up credits Khai Tran and Sylvie Mayer of OpenAI's Codex Security with the report, and Matteo Collina and Antoine du Hamel of Node.js with the fixes. Ron Masas of Imperva's Red Team demonstrated exploitability; Help Net Security says Imperva got remote code execution against the official Node.js 24.22.0 Linux arm64 image after multiple attempts.

Public proof-of-concept code is on GitHub. Threat-intelligence firm ELLIO told Help Net Security it recorded exploit traffic in the wild from 94.154.43.7, an address that has also carried PHP2Shell exploits (see our report on CISA's three-day PHP2Shell deadline). ELLIO's reading: "This is indicative of the RCE being adopted by an operator focused on mass exploitation." That is one firm's sensor data, and CISA's listing is the independent signal.

Why one library means a dozen patches

Brotli is bundled rather than shared. Wiz's table of affected products shows how many copies exist, and each ships its own fixed release.

Product	Affected	Fixed in
Google Brotli	1.0.3 to 1.2.0	1.0.10, 1.1.1, 1.2.1
Node.js	Unpatched 22.x, 24.x, 26.x	22.23.4, 24.22.1, 26.12.1
Python Brotli	1.0.3 to 1.2.0	1.2.1
Bun	1.0.21 to 1.4.3	1.4.4
Envoy Proxy	1.36.11, 1.37.7, 1.38.5, 1.39.2	1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0
Go andybalholm/brotli	Before v1.2.7	v1.2.7

Microsoft shipped out-of-band .NET updates on Oct. 25: .NET 8.0.33, 9.0.22 and 10.0.14, with .NET 11 at Release Candidate 3, BleepingComputer reports. Updating a system Brotli library does not help an app that bundles its own copy, so each container image and lockfile needs a rebuild.

1. Node.js disclosure (Oct. 21)236 days
2. CISA KEV listing (Oct. 27)242 days

Source: Help Net Security (fix commit Feb. 27), The Register (Node.js disclosure Oct. 21), CISA KEV feed (listing Oct. 27)

The score understates less than the default setting overstates

The score is inconsistent across sources. The Register reports that Microsoft's advisory gives 8.1 on CVSS v3.1 and rates exploitation "More Likely", while saying it has no evidence of successful criminal use. Neither Help Net Security nor BleepingComputer gives a score, so this article does not pick one.

Exposure depends on configuration. Microsoft says "Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install." In Node.js the path runs through node:zlib. Wiz, a vendor with a product to sell here, says 91 percent of cloud environments hold resources vulnerable to the flaw and 82 percent have publicly exposed Node.js instances; that is its own telemetry, not an independent count.

What to do before Nov. 10

Update dependency locks, rebuild images and redeploy, as Aikido Security advises. Node.js 20.x, 23.x and 25.x are also affected but will not get a fix, Help Net Security says, so those lines need an upgrade. Where patching must wait, Microsoft suggests blocking Brotli-compressed requests at a proxy or firewall, or disabling Brotli decoding.

The same toolchain-wide pattern shows up in package registries: our coverage of the OVHcloud CLI release hijack and the certificates Apple's git still trusts both turned on software nobody knew they carried. The next date is Nov. 10, when CISA's deadline lands.