CVE-2026-111497 in Brotli Decoder Prompts Cross-Ecosystem Security Updates

Summary

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. Researchers demonstrated inconsistent remote code execution against Node.js 24.22.0; multiple ecosystems have issued fixes, with exposure depending on whether attacker-controlled data reaches decompression

Key points

The flaw affects Brotli versions 1.0.3 through 1.2.0 and can cause memory corruption when a decoder processes specially crafted compressed data.
Exploitation is remote and requires no authentication or user interaction, but attacker-controlled content must reach a vulnerable decoder.
Researchers demonstrated remote code execution against Node.js 24.22.0 on Linux arm64 through inbound request processing and outbound content retrieval; success was inconsistent.
Updates are available across Node.js, Bun, Python Brotli, brotlicffi, Envoy, Istio, .NET, PowerShell, and Brotli releases.
Exposure depends on application configuration and data flows; Envoy and Istio require Brotli decompression to be enabled, while a bare Node.js HTTP server does not automatically decompress incoming Brotli request bodies.
Update to fixed releases, check for bundled Brotli decoders, and review whether untrusted data reaches decompression. Disabling Brotli decompression can reduce exposure where patching is delayed.

Article Details

Vulnerability Types: Out-of-bounds write
Unchecked return value
Severity: Google assigned CVSS v4 9.2; Node.js rates it High; Microsoft rates the .NET issue CVSS v3.1 8.1.
Affected Versions: Brotli 1.0.3 through 1.2.0
Exploitation Status: reported
Exploit Availability: public_poc
Patch Status: available
Workarounds: In affected Envoy and Istio deployments, disable Brotli decompression until updates are deployed.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationResearchers demonstrated remote code execution against a vulnerable Node.js deployment by supplying crafted Brotli-compressed content through request-processing and content-retrieval paths.

CVE

CVE-2026-111497A vulnerability in the Google Brotli decoder, tracked as CVE-2026-111497, has prompted security updates across multiple software ecosystems, including Node.js, .NET, PowerShell, Python Brotli, brotlicffi, Envoy, Istio,

Vendors

GoogleA vulnerability in the Google Brotli decoder, tracked as CVE-2026-111497, has prompted security updates across multiple software ecosystems, including Node.js, .NET, PowerShell, Python Brotli, brotlicffi, Envoy, Istio,MicrosoftMicrosoft rates the associated .NET issue as an elevation of privilege vulnerability with a CVSS v3.1 score of 8.1 and assesses exploitation as more likely.

Products