As of 28 October 2026, Brotli CVE-2026-111497 is a known-exploited vulnerability. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 27 October with a due date of 10 November. Fixes exist for Brotli itself, for supported Node.js lines and for supported .NET releases. What nobody has published is how the exploitation works, and CISA lists ransomware use as "Unknown", so don't wait for that detail. If you run Node.js or .NET services, or pay someone who does, you have two weeks to find out where Brotli data gets decompressed and which runtime does it. For the wider run of releases we track, see our platform and language release notes.
What changed on 27 October
CISA's catalog lists the entry under Google Brotli as an "Unchecked Return Value" flaw, tagged CWE-252 and CWE-787. Its description says the bug can "corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code". CISA also notes the flaw affects an open-source third-party library that different products can bundle. That second point is the whole difficulty: you may run Brotli without ever having chosen it.
The National Vulnerability Database (NVD) record, still marked "Undergoing Analysis", adds that CISA's own SSVC assessment recorded exploitation as "active" on 23 October, four days before the KEV listing. The CVE was published on 22 October.
The due date is the deadline CISA sets for US federal agencies under Binding Operational Directive 26-04. A private company isn't bound by it. Our judgment: treat 10 November as your deadline anyway, because exploitation is confirmed and patches have been out since 21 October.
One caution on wording. The vendors describe memory corruption that can mean a crash, memory disclosure or code execution. Brotli's own release notes say the out-of-bounds write "permits remote code execution". None of that tells you remote code execution has happened in the wild, and CISA doesn't say how the bug is being used.
Who is exposed
NVD's description says Brotli "1.0.3 through 1.2.0" is affected and calls it a buffer overflow in the decoder. The fixed releases are 1.0.10, 1.1.1 and 1.2.1. NVD also lists a CVSS 4.0 score of 9.2 (critical), the score Google assigned.
| Runtime | Fixed in (releases published with the 21 October advisory) | Exposure path |
|---|---|---|
| Node.js 22.x | 22.23.4 | Brotli data decompressed with node:zlib |
| Node.js 24.x | 24.22.1 | Same |
| Node.js 26.x | 26.12.1 | Same |
| .NET 8 | 8.0.33 | ASP.NET Core request decompression, HttpClient automatic response decompression, System.IO.Compression Brotli APIs |
| .NET 9 | 9.0.22 | Same |
| .NET 10 | 10.0.14 | Same |
| .NET 11 | RC3 | Same |
The Node.js security post, dated 21 October, rates it High. Its wording: an attacker who can supply Brotli data that an application decompresses with node:zlib "can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution". It doesn't say which inputs your application feeds into that call, so the question for your team is whether any code or middleware you run calls Brotli decompression on data from outside. Whether a given HTTP client or middleware does that by default isn't stated in either advisory, so check your dependencies rather than assume.
Microsoft's post of 25 October says the .NET paths are not on by default: "Request decompression and automatic response decompression are not enabled by default." Someone had to switch them on, or a library you use did. Microsoft says .NET Framework is not affected. For the others it says an unauthenticated attacker may be able to read or corrupt process memory.
If you ship a Next.js app on Node, the runtime patch is separate from framework advisories. Our write-up on which Next.js advisories hit your app covers the framework side.
Node.js lines with no fix
The Node.js previous-releases page lists Node 20, 23 and 25 as end-of-life. None appears in the fixed list, and the Node.js security post says "End-of-Life versions are always affected when a security release occurs". Treat services on those lines as exposed with no fix. The fix is a move to 22, 24 or 26, and that's a project with a date and a budget, not a hotfix. Our note on what an end-of-life Node line breaks shows how this plays out on a smaller scale.
Node 22 and 24 are LTS lines, so they're the sensible targets.
.NET and self-contained apps
Microsoft's warning is the one most teams will miss: "Installing a newer runtime on the host does not update the runtime bundled with your application." A self-contained .NET app carries its own runtime. Patching the server does nothing for it. You rebuild the app against a fixed runtime and redeploy.
How to patch Brotli CVE-2026-111497 before 10 November
1. Name one owner
Done means one named person for each of your in-house services, agency-built apps and vendor products, each with a date. If nobody can say who patches the runtime under an agency's Node service, you've found the real problem.
2. Inventory where Brotli runs
Done means a list of services with the Node.js or .NET version, whether the app is self-contained, and whether any code path decompresses Brotli. Search for node:zlib Brotli calls, ASP.NET Core request decompression settings, HttpClient automatic decompression and System.IO.Compression Brotli use. Container base images and bundled copies of the library come next, since CISA says other products can embed it.
3. Patch internet-facing systems first
Done means the fixed version is running, not just downloaded. The fixes are the Node.js releases published with the 21 October advisory (22.23.4, 24.22.1 and 26.12.1), and .NET 8.0.33, 9.0.22 and 10.0.14. .NET 11 users need RC3. For anything outside those lines, plan the upgrade rather than waiting for a backport.
4. Rebuild images and self-contained apps
Done means new images and binaries are deployed and the old ones removed. A base image pinned to an old Node tag keeps the old runtime until you rebuild it. The same goes for every self-contained .NET app.
5. Confirm what is running
Done means someone checked the runtime version on the live process, not the repository or the build file, and saved the output with the date. If an internet-facing service was unpatched from 21 October on, review it. That's our judgment, not a CISA instruction.
Questions to put to vendors and agencies
Send these in writing and ask for a written reply. A call isn't evidence.
- Which Brotli version and which Node.js or .NET version does each product you supply to us bundle?
- Do any of them use request decompression,
node:zlibBrotli or Brotli through System.IO.Compression, and on what data? - When was each image or self-contained build last rebuilt, and when will the patched one ship?
- Which of your products run on Node.js 20, 23 or 25, and what is the upgrade date?
Other runtimes and tools bundle Brotli too, and they publish their own advisories. Ask vendors about those as well. We haven't verified fix versions for any of them, so we're not listing numbers.
What this means for who owns runtime patching
The decision this week is who is accountable for runtimes across everything you run, including the services an agency or vendor operates for you. KEV puts a fixed date on that accountability, and a bundled-library flaw like this one is where an unowned estate shows up.
Decide three things by 10 November. Put a named owner on every segment. Require written answers from each supplier to the questions above. And if any service sits on Node 20, 23 or 25, approve the upgrade work now, since none of those lines is in the fixed list. The same questions feed your contractor paperwork: answering contractor security questionnaires is the next place to go. We'd keep suppliers' written answers in the same file as their security attestations. The previous KEV pattern, with the same inventory request, is in the PHP2Shell KEV plan.
FAQ
What is CVE-2026-111497?
It's a memory corruption flaw in the Brotli decoder, a compression library bundled in many products, including Node.js and .NET. NVD's description lists 1.0.3 through 1.2.0 as affected; fixed releases are 1.0.10, 1.1.1 and 1.2.1. The vendors describe outcomes from a crash to memory disclosure to code execution.
Is the Brotli vulnerability being exploited?
Yes. CISA added it to KEV on 27 October, which means exploitation is confirmed, and its SSVC assessment recorded "active" on 23 October. CISA hasn't said how it is exploited or whether ransomware groups use it.
Which Node.js versions are affected?
Node.js 26.x, 24.x and 22.x, with fixes in the releases published with the 21 October advisory (26.12.1, 24.22.1 and 22.23.4). The Node.js post says end-of-life versions are always affected when a security release occurs, and the previous-releases page lists 20, 23 and 25 as end-of-life, so treat those as exposed with no fix. Exposure arises when an application decompresses attacker-supplied Brotli data with node:zlib.
Does .NET Framework need patching?
No. Microsoft says .NET Framework is not affected. Modern .NET 8, 9, 10 and 11 are, and self-contained apps need a rebuild.
Do I need to act if I don't use Brotli on purpose?
Possibly. CISA flags this as a library that different products embed, so you can be exposed without choosing it. Inventory first, then ask your suppliers. If nothing decompresses Brotli data, you'll have a record that says so.