CVE-2026-111497 Brotli: Google's Decoder Added to CISA KEV, Node.js, .NET, Envoy and Bun Affected

CVE-2026-111497 was published by NVD on October 22, 2026. Five days later, on October 27, CISA added it to the KEV catalog with a remediation deadline of November 10.

This isn't a flaw in a product. It's in a compression library: Google's Brotli decoder. Brotli decompresses HTTP content (Content-Encoding: br), WOFF2 fonts, archives and columns in analytics databases. It ships inside Node.js, .NET, Envoy, Bun, ClickHouse, DuckDB, Apache Arrow and more — the NVD configuration alone lists around fifteen products.

So the real question isn't "do I use Brotli?" but "where is it bundled in my stack?".

The Vulnerability

NVD description (excerpt):

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory […]

What a Malicious Brotli Stream Can Do

According to NVD, a remote, unauthenticated attacker who gets a crafted Brotli stream decoded can:

• corrupt the decoder's state memory;
• disclose sensitive memory contents;
• cause a denial of service;
• potentially execute arbitrary code.

The KEV entry names the root cause: an unchecked return value in the decoder. The code carries on as if an operation had succeeded, then writes past the intended buffer.

Why the Attack Surface Is So Wide

A decompressor, by definition, processes data from outside: the body of a compressed HTTP request, a response from an upstream server, an uploaded file, a web font. Any service that decompresses Brotli received from a third party exposes this code — often without the team running it knowing.

That also explains the gap between the two scores: NVD scores the worst case (9.8), while Google adds AT:P (attack prerequisites) and lands at 9.2. Both are CRITICAL.

Affected Versions

Brotli Itself

The NVD description is explicit: update any Brotli library or binary between 1.0.3 and 1.2.0 to 1.0.10, 1.1.1 or 1.2.1.

Products That Bundle It (NVD Configuration)

⚠️ These are bounds taken from NVD, not necessarily the version to install. For products listed as "up to and including", NVD gives no fixed version: check the vendor's advisory. For Node.js, .NET and Debian, the matching security announcements are cited in the NVD references.

The list isn't exhaustive. Any application that statically links Brotli or ships its own copy (container images, Go or Rust binaries, appliances) may be affected without showing up in NVD.

Detection

The hard part here is inventory, not spotting an attack.

Find your copies of Brotli:

# System libraries
ldconfig -p | grep -i brotli
dpkg -l | grep -i brotli      # Debian / Ubuntu
rpm -qa | grep -i brotli      # RHEL / Fedora

# Version bundled in Node.js
node -p "process.versions.brotli"

• Application dependencies: search lockfiles (package-lock.json, requirements.txt, go.sum, Cargo.lock) for brotli, brotlicffi, andybalholm/brotli
• Container images: an image scanner (SBOM) will surface Brotli copies baked into layers
• Proxies and service meshes: Envoy and Istio decompress the traffic flowing through them

Signs of exploitation: repeated crashes (segfaults) in processes that decompress content, especially after requests carrying Content-Encoding: br.

Mitigation

1. Update Brotli and Everything That Bundles It

The CISA deadline is November 10. Updating the system library isn't enough: Node.js, .NET, Bun and Envoy ship their own copy and need their own updates.

2. Rebuild Your Images

A container built before the fix keeps the old version. Rebuild and redeploy — don't just patch the host.

3. In the Meantime, Reduce Exposure

Where possible, reject Content-Encoding: br on inbound requests at the proxy or web server. It's a stopgap: it won't protect a client that downloads Brotli content from a malicious server.

4. Forensic Triage

The KEV entry points to directive BOD 26-04, which requires forensic triage on top of patching. For any exposed service that may have processed Brotli from an untrusted source, review processes, outbound connections and recently modified files.

Why Continuous Monitoring of Your Components Matters

A flaw in a compression library doesn't carry the name of any product you bought. It arrives through Node.js, through .NET, through the proxy in front of your services. Without an inventory of what versions are running, there's no way to know within five days what's exposed.

With cveo.tech, inventory your servers, runtimes and devices with their exact versions, and get an automatic alert whenever a CVE affecting them is published or enters the CISA KEV catalog.