CISA lists exploited Brotli decoder flaw CVE-2026-111497
First merged summary.
CVE-2026-111497, a Brotli out-of-bounds write, is patched in Node.js and listed by CISA as exploited.
CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder, scored CVSS 9.2, that a missed error check can turn into a remote-code-execution primitive when Content-Encoding: br data is decompressed. Node.js patched supported lines on October 21, 2026, in 22.23.4, 24.22.1, and 26.12.1; end-of-life 20.x, 23.x, and 25.x have no fixes. The same library flaw affects Python, Bun, .NET, Java brotli4j, Envoy, Istio, and PHP via libcurl, including stock WordPress. CISA added the CVE to the Known Exploited Vulnerabilities catalog on October 27 after confirmed exploitation, with a November 10 federal deadline. Public WordPress tooling is limited to denial of service; Patchstack says no public code-execution chain targets PHP.
- Fixed Node.js releases are 22.23.4, 24.22.1, and 26.12.1.
- Brotli fixes are 1.0.10, 1.1.1, and 1.2.1; affected range is 1.0.3–1.2.0.
- Patched Node.js 24.22.1 still reports process.versions.brotli as 1.2.0.
- CISA KEV deadline for federal agencies is November 10, 2026.
- Cisco rates the issue High SIR for products using Node.js.
- Rejecting inbound Brotli bodies does not stop malicious compressed responses.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Node.js and Brotli publish fixes for CVE-2026-111497 · Cisco Security Advisories
- Oct 22, 2026Public proof of concept for the Node.js bug appears · Datadog Security Labs
- Oct 26, 2026Large lab request from 94.154.43.7 fails in 50 attempts · GBHackers
- Oct 27, 2026CISA adds CVE-2026-111497 to the KEV catalog · GBHackers
What each outlet adds
beyond the shared facts- Zscaler ThreatLabzDescribes the missed DecodeBlockTypeAndLength check and inbound versus outbound paths.
- Datadog Security LabsNames other affected runtimes and the unchanged Brotli version string.
- GBHackersReports ELLIO shells and failed crashes that can dump secrets.
- PatchstackShows WordPress exposure through libcurl and xmlrpc.php pingback.
- Ubuntu Security NoticesConfirms the same Brotli flaw can hit .NET decompression.
- Organizations
- CISADatadogImpervaELLIOZscaler ThreatLabz
Coverage
oldest first · one row per article · UTC- · 3d ago
Zscaler ThreatLabzFirst report
Brotli flaw CVE-2026-111497 may allow RCE via crafted streams
A missed error check in Brotli block decoding can cause an out-of-bounds write when Content-Encoding: br data is decompressed.
- · 3d ago
Cisco Security Advisories
Cisco warns October 2026 Node.js flaws can enable RCE
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
- · 2d ago
Datadog Security Labs
Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
- · 2d ago
GBHackers
CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
- · 2d ago
Ubuntu Security Notices
Ubuntu fixes .NET debug-proxy and Brotli flaws
The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.
- · 1d ago
Patchstack
Stock WordPress pingback can crash workers via Brotli CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-105482 | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |