Brotli Decoder Flaw CVE-2026-111497 Is Exploited, Patch by Nov. 10

A remote, unauthenticated attacker who can get a crafted Brotli stream in front of a vulnerable decoder can corrupt memory, crash the service or, in some cases, run code. CISA added the flaw, CVE-2026-111497, to its Known Exploited Vulnerabilities catalog on Oct. 27, and federal civilian agencies must patch by Nov. 10 under Binding Operational Directive 26-04.

The flaw is an out-of-bounds write (CWE-787) with an unchecked return value (CWE-252) in the C decoder of Brotli, Google's lossless compression library. Per Field Effect's write-up, the fast decode path ignored return values from block-switch functions, so decoding continued after a failure. Google scores it CVSS 4.0 9.2. Brotli 1.0.3 through 1.2.0 are affected; fixes are in 1.0.10, 1.1.1 and 1.2.1.

Which runtimes carry their own copy

Brotli is rarely installed once. Field Effect lists the fixed releases for each product that embeds it:

Product	Fixed version
Node.js	22.23.4, 24.22.1, 26.12.1
Bun	1.4.4
Python Brotli	1.2.1
.NET	8.0.33, 9.0.22, 10.0.14
Envoy	1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12
Istio	1.31.2, 1.30.6, 1.29.9

Official Node.js and Bun builds bundle their own Brotli implementation, so updating the operating system package alone may not remediate them. Node.js 20.x and other end-of-life lines are not fixed. Istio 1.29 reached end of life on Oct. 15, so 1.29.9 is a stopgap rather than a destination. Microsoft rated its .NET variant an elevation of privilege at CVSS 3.1 8.1 with exploitation assessed as more likely, and BleepingComputer reports Microsoft shipped an emergency .NET update on a Sunday.

What is exposed and what is not

Exposure depends on whether untrusted Brotli data reaches a decoder. Envoy and Istio are exposed only when Brotli decompression is enabled. .NET is exposed when its Brotli APIs process untrusted data. A bare Node.js HTTP server does not automatically decompress incoming Brotli request bodies, but outbound fetches of attacker-controlled content can still reach the decoder. Field Effect reports researchers achieved code execution against an official Node.js 24.22.0 Linux arm64 build through both inbound request handling and outbound retrieval, though not consistently.

Timeline and the exploitation question

Node.js shipped its security release on Oct. 21, 2026, and Field Effect says public GitHub repositories demonstrating exploitation appeared within hours. Field Effect's post, dated Oct. 26, reported no confirmed in-the-wild use. The next day CISA listed the CVE as exploited. BleepingComputer, which describes the bug under the names Node2Shell and HTTP2Shell, does not name the attackers, and neither does the CISA catalog entry. Whether exploitation is broad or limited is not public.

What to do

Update each runtime to the version above, restart the affected processes and rebuild and redeploy container images that bundle a vulnerable copy. BleepingComputer's mitigation if patching must wait is to block Brotli-compressed requests at the proxy or firewall or to disable Brotli decoding. Field Effect adds a caution: compressed traffic may reach other decompressing services downstream, so check those first. For other recent catalog entries, see our reports on the PHP memory-corruption chain and the WordPress 7.1.4 race condition.

The federal deadline is Nov. 10, three days before the Nov. 13 date on the Ivanti Connect Secure listings.