CVE-2026-111497: Brotli decoder RCE now on CISA exploited list

On October 27, 2026, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog. The bug is an out-of-bounds write in the decoder of Google's Brotli library, the C code behind Content-Encoding: br. Node.js disclosed it on October 21, but the same library ships as libbrotli1 on every mainstream Linux distribution and is bundled inside Node.js, .NET, Bun, Envoy, Python wheels and the PHP brotli extension. Patching one of those does not patch the others.

Decoder bug in Brotli 1.0.3 through 1.2.0

A crafted Brotli stream containing an invalid block-type switch was treated by the decoder as a temporary need for more input instead of a format error. The streaming decoder kept appending input to an eight-byte internal buffer and wrote past its end. Depending on the target, the result is a crash, a leak of process memory, or code execution. Khai Tran and Sylvie Mayer of OpenAI Codex Security reported it.

Affected upstream ranges are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. Google committed the fix to the public repository on February 27, 2026, with no release and no advisory. Anyone reading the commit history had eight months to work out what it fixed before tagged releases appeared alongside the Node.js advisory.

Scores vary by vendor. Google, as the CNA, rates it 9.2 under CVSS 4.0. Red Hat and Microsoft both give 8.1 under CVSS 3.1 and mark attack complexity as high. Node.js calls it High, and Ubuntu assigns Medium priority.

Exploitation status as of October 28

• Imperva demonstrated code execution against the official Node.js 24.22.0 Linux arm64 image. It took multiple attempts, and Imperva has not published the exploit.
• Proof-of-concept code is on GitHub, at least one claiming code execution under lab conditions.
• On October 26, threat intelligence firm ELLIO recorded exploit traffic against Node.js from an address it had previously seen in PHP exploit campaigns.
• CISA listed the CVE as exploited the next day. Red Hat's CVE page still says no reliable public RCE exploit exists.

Applications that decode attacker-supplied Brotli

A vulnerable library on disk is not enough. Something has to decompress Brotli data an attacker controls, either an incoming request body or a response from a hostile server.

• Node.js: zlib.brotliDecompress() on untrusted input; the built-in fetch(), which decompresses br responses automatically; and Express 5 with body-parser 2, whose parsers inflate request bodies by default. Any client can send Content-Encoding: br to an Express 5 endpoint.
• Python: requests and urllib3 decode br responses whenever the Brotli or brotlicffi package is installed. Fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0.
• PHP: the curl extension uses the system libcurl, and Debian's libcurl package depends on libbrotli1. WordPress's HTTP library sets CURLOPT_ENCODING to an empty string, which tells libcurl to accept every encoding it was built with, so a WordPress site fetching a URL from a hostile server hands the response to the system decoder. The separate PHP brotli extension carries its own copy, fixed in 0.21.1. PHP for Windows builds are fixed in 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1.
• Others: .NET 8.0.33, 9.0.22 and 10.0.14, Bun 1.4.4, and current Envoy and Istio point releases contain the fix.

Web servers that compress responses are on the encoder side. Apache's mod_brotli is documented as an output filter only, and Red Hat places the flaw in c/dec/decode.c, the decoder.

Fixed libbrotli1 packages for Debian and Ubuntu

sudo apt update
sudo apt install --only-upgrade libbrotli1
dpkg -l libbrotli1

• Ubuntu 26.04 LTS: 1.2.0-3ubuntu0.1
• Ubuntu 24.04 LTS: 1.1.0-2ubuntu0.1
• Ubuntu 22.04 LTS: 1.0.9-2ubuntu0.1
• Debian 13: 1.1.0-2+deb13u1 (DSA-6582-1)
• Debian 12: 1.0.9-2+deb12u1 (DLA-4855-1)

Ubuntu 20.04 was still marked "needs evaluation" on October 28, and its nodejs package is listed as vulnerable. Distribution packages keep the upstream version number and backport the patch, so a scanner that reads "1.1.0" may flag a fixed server. Ubuntu and Debian's own nodejs packages link the system library and need only the libbrotli1 update. On RHEL, Red Hat says the system brotli package must be updated even where the Node.js or .NET package needs no change.

Copies that apt and dnf do not update

• Node.js installed from nodejs.org, NodeSource, nvm or the official Docker images bundles Brotli. Check node -v and move to 22.23.4, 24.22.1 or 26.12.1. Node 20 and older, plus 23 and 25, get no fix.
• Python virtual environments: run pip list | grep -i brotli in each one. The PyPI wheels include their own compiled library.
• PHP brotli extension: php --ri brotli shows whether it is loaded.
• Container images need a rebuild and redeploy. Updating the host does nothing for a library inside an image.

Rejecting Brotli request bodies at the proxy

If a Node.js application cannot be upgraded today, refuse compressed request bodies in front of it. For nginx, inside the server block:

if ($http_content_encoding ~* br) {
    return 415;
}

For Apache with mod_rewrite:

RewriteEngine On
RewriteCond %{HTTP:Content-Encoding} br [NC]
RewriteRule ^ - [F]

In Express, setting inflate: false on the body parsers has the same effect. None of this protects outbound requests to hostile servers, which only the patch fixes.

Finding processes still running the old library

Running services keep the old libbrotli mapped in memory until they restart. PHP-FPM pools, Node.js process managers and Apache with mod_php are the usual holdouts. List them with:

sudo grep -l 'libbrotli.*(deleted)' /proc/[0-9]*/maps 2>/dev/null

Each path contains a PID; ps -p PID -o unit,cmd names the service to restart. On Debian and Ubuntu, sudo needrestart -r l produces the same list. On the servers Falcon Internet manages, this deleted-library check follows every shared-library security update. An empty result from the grep means no running process is still using the vulnerable copy from the distribution package.