Brotli CVE-2026-111497 is now on CISA's exploited list, and you probably run more copies than you think

BrotlidefinitionGoogle's compression format, the one behind Content-Encoding: br. Lots of software copies Google's C library for it instead of writing its own. is the compression code that unpacks a lot of web traffic, and CISA now lists a flaw in it as exploited. Anything that decodes Brotli with Google's library from 1.0.3 to 1.2.0 needs the fixed build, and US federal agencies have until November 10. Node.js is the best-known case, but the same decoder sits inside Python packages, .NET, proxies and some firewalls.

Most patch news is about one product. This one is about a part that many products share, so the hard work is finding where it hides. A server you patched last week can still carry an old Brotli inside a Node binary, a Python wheel or a container image built in August.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 27, which is where it lists bugs it has evidence of attacks against. CISA's own notes call Brotli an open-source component that could be used by different products, and that's the real warning. Palo Alto Networks says it isn't aware of any malicious exploitation, so read the KEVdefinitionCISA's list of flaws it has seen attacked. Once a bug is on it, US federal agencies get a deadline. It's a sensible list for anyone else to patch from first. listing as being about Brotli in general, not about any one vendor.

How bad it gets depends on what your software does with compressed data from outside. Imperva's red team ran their own code on the official Node.js 24.22.0 image for Linux arm64, using a Brotli body sent to Express and a Brotli response pulled in by fetch(). It took them several attempts. Red Hat says hardening such as ASLR makes code execution harder on its systems, though it still expects crashes.

For engineers: the weakness is filed as CWE-252, an unchecked return value, leading to CWE-787, an out-of-bounds write. Before the fix, DecodeBlockTypeAndLength() returned a plain true or false, so callers couldn't tell a broken stream from one that had simply run out of input. The fast decode path threw the result away. Google's fix, commit 0ed4268 ("Detect and report invalid stream earlier"), makes the function return an error code and adds a new one, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, so decoding stops on both paths.

Don't let a medium label on a Linux package slow you down. A researcher on the oss-security mailing list warned on October 23 that people might read the Node.js advisory and decide they had nothing to worry about because they don't run Node. He also questioned Ubuntu's medium rating. The library is the problem, and it's in a lot of places.

Google released three fixed builds on the same day, one for each 1.x line people still use, so nobody has to move to a newer line. The hard part is that most of your software doesn't use Google's build directly. Each product that copied Brotli in has to ship its own update, and you have to install each one.

The February date explains something odd in the vendor lists. A few projects, MuPDF according to an independent tracker and Ghostscript according to a post on oss-security, pulled in the change before anyone knew it mattered, so their recent builds were fixed early. Others still bundle the old decoder. That tracker listed DuckDB, the bundled Apache Arrow build, p7zip and 7-Zip-zstd as unpatched on October 27, mostly through Parquet files and archives a user opens.

Some paths are easy to miss. A researcher on oss-security pointed out on October 26 that git's HTTPS transport is exposed too, when libcurl is built with Brotli support, which he says most distributions do. So a build server cloning from a hostile mirror counts. On those systems the distribution's libbrotli update covers git, once nothing still has the old library loaded.

If you only have an hour, start with services that unpack data from the internet: public APIs that accept compressed bodies, crawlers and link previewers, webhooks and anything that imports from a URL. Imperva showed both directions work, data coming in and data your app goes out and fetches. A WAF can catch the first one. Nothing in front of your app sees the second.

# example output, with made-up versions. Run these on every host and inside every image, because each can differ
node -p "process.version + ' brotli ' + process.versions.brotli"   # Node's own copy, which is the one that counts
v24.22.0 brotli 1.2.0
pip show Brotli brotlicffi | grep -E 'Name|Version'   # run it in each virtualenv, since they don't share packages
Name: Brotli  Version: 1.2.0
dpkg -l | grep -i brotli
ii  libbrotli1:amd64  1.1.0-2ubuntu0.1
sudo grep -l brotlidec /proc/*/maps 2>/dev/null
/proc/2214/maps
# The package is patched but process 2214 still has the old library loaded. Restart it

This bug is a preview of how shared components fail. The flaw sat in one C file, and the fix took a week to reach a handful of big projects while others are still waiting. Teams that already knew where Brotli lived had a short week. Everyone else spent it searching.

Two of these do most of the work. An SBOMdefinitionA software bill of materials: a list of the components inside an application or image. It lets you search for a library like Brotli instead of asking every team. you can search turns 'are we affected?' from a week of emails into an afternoon. A scoped identity limits what an attacker gets if a decoder bug does turn into code execution, because the process can only reach what it was meant to. Our post on the PHP2Shell and Node.js releases walks through scoping the app account in more detail.

Memory bugs leave little behind. A crash in a decoder can be a failed attempt or a broken file from a partner, and a successful attempt might not crash anything. That's why the rotation step matters even when the evidence is thin.

These three are made up, and none is a real incident or a Cohash client. Each version number in them comes from the vendor pages behind this post.

We help teams find shared components like Brotli across images, runtimes and appliances, patch them in an order that keeps services up, and scope the identities those services run under. Our DevSecOps practice handles SBOMs and image rebuild pipelines, and our network security team works on firewall inspection settings. If you'd like a second pair of eyes on your exposure, start with an assessment.