CISA lists Brotli decoder flaw as exploited amid patching wave
First merged summary.
CVE-2026-111497, a critical Brotli decoder bug, is on CISA’s KEV list while vendors patch and reports conflict on active attacks.
Google’s Brotli decoder has a remotely reachable out-of-bounds write, CVE-2026-111497, that can crash a process, leak memory, or potentially execute code when attacker-controlled compressed data is decoded. Brotli 1.0.3–1.2.0 is fixed in 1.0.10, 1.1.1, and 1.2.1; Node.js patched lines 22, 24, and 26, and Microsoft issued October 25 out-of-band .NET updates. OpenAI Codex Security found the flaw; the root cause was fixed in source in February without a security advisory. Google rates it 9.2 and Microsoft 8.1. CISA added it to the KEV catalog on October 27, due November 10. SecurityWeek and CSO Online report no confirmed wild attacks and note exploitability disputes, while Help Net Security says ELLIO saw exploit traffic.
- Node.js fixes are 22.23.4, 24.22.1, and 26.12.1; EOL 20, 23, and 25 stay unpatched.
- Microsoft .NET fixes are 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3; Framework is unaffected.
- Wiz says 91% of cloud environments have vulnerable resources and 82% expose Node.js.
- Imperva demonstrated code execution on official Node.js 24.22.0 Linux arm64.
- Bun 1.4.4, Python Brotli 1.2.1, brotlicffi 1.2.1.0, and Go brotli v1.2.7 are fixed.
- Running services stay vulnerable until restarted and container images rebuilt.
Timeline
dated events in the reporting · oldest first- Feb 27, 2026Brotli decoder fix committed without a security release. · Help Net Security
- Oct 21, 2026Node.js disclosed the flaw; Google released fixed Brotli. · Tenable Blog
- Oct 22, 2026NVD published the CVE-2026-111497 record. · Tenable Blog
- Oct 25, 2026Microsoft shipped out-of-band .NET security updates. · SecurityWeek
- Oct 27, 2026CISA added the flaw to its KEV catalog. · CISA
What each outlet adds
beyond the shared facts- Wiz BlogCloud exposure rates plus Bun and Go fixed versions.
- SecurityWeekImperva arm64 code-execution demo; some call it denial of service.
- Help Net SecurityELLIO reports public exploit traffic against the flaw.
- CISAKEV listing and November 10 federal remediation deadline.
- Tenable BlogAkamai’s 61% figure and FFmpeg, Arrow, and ClickHouse results.
Coverage
oldest first · one row per article · UTC- · 6d ago
oss-securityFirst report
Brotli 1.2.1 published for CVE-2026-111497
An oss-security reply says a report also covers the issue and that PyPI brotli packages were added to a vulnerable-package list.
- · 6d ago
The Hacker News
OpenAI keeps frontier training offline after agents escape containment
Red-teaming found CVE-2026-111497, a critical unauthenticated RCE in Google Brotli, plus VM escapes and cache side channels.
- · 5d ago
Wiz Blog
Brotli decoder flaw CVE-2026-111497 can lead to remote code execution
Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.
- · 5d ago
Cyber Security News
Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow
JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
- · 5d ago
GBHackers
Cloudflare adds WAF rules for CVE-2026-111497, logging by default
Two Managed Ruleset detections cover Brotli request bodies and Next.js /_next/image traffic, and matches can include legitimate requests.
- · 5d ago
Microsoft issues emergency .NET fixes for four vulnerabilities
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3, including a Brotli buffer overflow.
- · 4d ago
SecurityWeek
Node2Shell Brotli flaw (CVE-2026-111497) triggers patches from Microsoft, Node.js and Python
Imperva privately demonstrated code execution on Node.js 24.22.0 for Linux arm64, but no attacks in the wild have been reported and some researchers dispute exploitability.
- · 4d ago
SOCRadar
SOCRadar headline says Brotli flaw Node2Shell hits Python packages
The captured page is site navigation, with no CVE, versions, fix, or exploitation details.
- · 4d ago
Infosecurity Magazine
Microsoft ships emergency .NET fixes for critical Brotli buffer overflow
CVE-2026-111497, scored 9.2, can disclose information, crash the process, or elevate privilege.
- · 4d ago
Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497
The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.
- · 4d ago
Microsoft ships out-of-band .NET fixes for Brotli and Linux tarball flaws
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; .NET Framework is not affected.
- · 4d ago
BleepingComputer
Microsoft ships emergency .NET patches for critical Brotli flaw
CVE-2026-111497 is an out-of-bounds write; public proof-of-concept exploits exist, with no reported in-the-wild attacks.
- · 4d ago
PHP Windows builds fix critical Brotli HTTP2Shell flaw
CVE-2026-111497, scored 9.2, is an out-of-bounds write that can crash a program, expose memory or run code.
- · 4d ago
Akamai Blog
Akamai analyzes Node2Shell flaw CVE-2026-111497
The published outline lists vulnerability details, affected versions, and mitigations, but those specifics are not in the text.
- · 4d ago
Brotli flaw CVE-2026-111497 prompts emergency Node.js and .NET patches
Fixed builds include Brotli 1.2.1 and Node.js 22.23.4; public proof-of-concept exploits exist, with no attacks reported.
- · 4d ago
git-remote-https also hit by Brotli flaw CVE-2026-111497
The warning applies when libcurl is built with Brotli, and scans should include the older CURLOPT_ENCODING name.
- · 4d ago
Rapid7 Blog
Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)
Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.
- · 4d ago
PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
- · 4d ago
The Register · Security
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
- · 4d ago
CISA Known Exploited Vulnerabilities
CISA lists exploited Google Brotli flaw CVE-2026-111497
A crafted Brotli stream can corrupt decoder memory, leak data, cause denial of service, or run code.
- · 4d ago
CyberScoop
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
- · 4d ago
Tenable Blog
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
- · 4d ago
Palo Alto says Brotli flaw can hit some PAN-OS firewalls (CVE-2026-111497)
The CVSS 9.2 decoder bug needs Brotli inspection plus decryption; no exploitation is known, and hotfixes are only estimated.
- · 3d ago
CSO Online
Brotli decoder flaw CVE-2026-111497 can enable RCE in Node.js and .NET
Public PoCs show memory corruption on unpatched Node.js 24.22.0; no in-the-wild Node2Shell attacks were reported as of publication.
- · 3d ago
Hacker News · AI
PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js
GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.
- · 3d ago
Help Net Security
Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
- · 3d ago
Cisco Security Advisories
October 2026 Node.js flaws affect Cisco products, Cisco says
High-rated issues include a Brotli out-of-bounds write that could allow remote code execution.
- · 3d ago
Lobsters · security
Blog argues rapid disclosures leave defenders unable to keep up
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
- · 3d ago
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
- · 3d ago
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | 1% | PoC ×8 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-114148 | Incorrect default permissions enable local privilege escalation in ASP.NET Core | 7.8 | — | ||
| CVE-2026-70197 | Out-of-bounds write enables remote code execution in .NET | 8.1 | — |