Brotli Vulnerability CVE-2026-111497: Is Your Node.js or Python Affected?

Where things stand on 27 October 2026

CVE-2026-111497 is listed in CISA's catalogue as the "Google Brotli Unchecked Return Value Vulnerability", with the weakness types CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write). In plain terms, the code that unpacks Brotli-compressed data can be tricked by a crafted stream into writing outside the memory it should be using. CISA's catalogue describes the possible outcomes as corrupted memory, disclosed memory, a crash or, potentially, running attacker code. Google, which issued the CVE, scores it 9.2 (Critical) under CVSS v4.0.

The position changed during the week. Reports dated 24 to 26 October, including one from Rapid7, said no exploitation had been reported and that the flaw was not yet in KEV. CISA added it on 27 October. The catalogue entry lists known ransomware use as unknown, and neither it nor CISA's alert says who is exploiting the flaw or against what. Do not read the listing as meaning your systems are compromised, and do not read the lack of detail as meaning you are safe.

Fixes already existed before the KEV listing. Google released Brotli 1.0.10, 1.1.1 and 1.2.1 on 21 October 2026 and Node.js shipped fixed releases the same day. That makes this mainly a job of finding the copies you have and updating them.

Who should check

The flaw sits in Google's Brotli decoder, not in one application, so it turns up wherever that decoder is compiled in. Upstream Brotli versions 1.0.3 up to but not including 1.0.10, 1.1.0 up to but not including 1.1.1, and 1.2.0 up to but not including 1.2.1 are affected. The risk is real when your software decompresses Brotli data that someone outside your control can supply. That might be a request body, a response fetched from another site or an uploaded file.

Brotli is often switched on without anyone choosing it, because web servers, HTTP clients and frameworks negotiate it automatically. Treat an application as in scope until you know otherwise if it faces the internet or fetches content from sites you do not control.

• Node.js 22.x, 24.x and 26.x before 22.23.4, 24.22.1 and 26.12.1. The Node.js advisory names the node:zlib Brotli functions; it does not say whether built-in HTTP or fetch paths reach the same code, so patch rather than argue the point. Rapid7 advises treating end-of-life Node.js lines as affected and moving to a supported release.
• Python packages brotli (affected from 1.0.3 before 1.2.1) and brotlicffi (from 1.0.3 before 1.2.1.0). These often arrive as a hidden dependency of an HTTP library.
• The .NET runtime on .NET 8, 9, 10 and the .NET 11 release candidate. Microsoft says .NET Framework is not affected, and that request decompression and automatic response decompression are not enabled by default, but the System.IO.Compression Brotli APIs are affected wherever you use them.
• Envoy, Istio, Bun and the Java library brotli4j, each of which has published its own advisory and fixed versions.
• Linux system libraries and anything that uses them, including container images. Red Hat lists RHEL 7, 8, 9 and 10 and products built on them as potentially affected.
• Software with its own bundled runtime: Electron-style desktop apps, Node.js or Bun programs packaged into a single executable, and self-contained .NET applications. Updating the operating system or a shared runtime does not touch these.

What to do now

Start with exposure, then work outwards. The first pass is read-only, and the commands below only report versions. Run each one in the place your application actually runs - inside the container, the virtual environment or the service account's environment - because the answer on your admin laptop may be irrelevant.

Do not rely on a version number printed by Brotli itself. Reporting from Tanium notes that Node.js can still show an old Brotli version string after it has been fixed, and that Linux distributions often keep the old upstream number when they backport a fix. Judge by the Node.js version, the package release or the vendor's advisory.

1. Make a short list of what decompresses outside data and who can reach it. Internet-facing web applications, APIs, reverse proxies, upload handlers and anything that fetches pages or files from third parties come first. Internal-only tools come later.
2. On Node.js hosts, check the runtime version. Fixed releases are 22.23.4, 24.22.1 and 26.12.1 or later. Any other major line is either older and unfixed or out of support, so plan a move to a supported release.
   bashCopy

   node --version

3. On Python hosts and in virtual environments, list the two Brotli packages. A not-found warning for one of them is normal. You need brotli at 1.2.1 or later and brotlicffi at 1.2.1.0 or later.
   bashCopy

   python3 -m pip show brotli brotlicffi

4. On .NET hosts, list the installed runtimes. You are looking for 8.0.33, 9.0.22 or 10.0.14 or later. Self-contained applications carry their own runtime and will not appear here, so check how each one was published.
   bashCopy

   dotnet --list-runtimes

5. On Linux servers, list installed Brotli packages and compare them with your distribution's security notice. Debian has published fixes for bookworm (1.0.9-2+deb12u1) and trixie (1.1.0-2+deb13u1). Red Hat's bulletin had not listed fixed package versions when we checked on 27 October, so look at its current status before assuming a patch is waiting.
   bashCopy

   dpkg -l | grep -i brotli

   bashCopy

   rpm -qa | grep -i brotli

6. Apply the updates and restart the affected services. A restart briefly interrupts them, so use your normal change window if the service is customer-facing, but do not let that window drift for days on an internet-facing system. A running process keeps the old code in memory until it restarts.
7. Containers, packaged executables and self-contained .NET applications need rebuilding or republishing from an updated base or runtime, then redeploying. Installing a new runtime on the host does not change them.
8. Confirm the result. Re-run the relevant version check in the same environment that serves traffic, and confirm the process was restarted after the update. For containers, check the image actually running, not only the one you built.

Fixed versions and how to get them

These are the fixed releases we could confirm from vendor or primary advisories. Where a product is not listed, check its own security page. The names Node2Shell and HTTP2Shell that appear in news coverage refer to this same CVE, and the npm package called brotli is a separate JavaScript library, so do not match by name alone.

For Python, upgrade inside the same environment that uses the package. Use only the line for the package that pip show reported, and update any pinned requirements file, otherwise the next deployment may restore the old version. If the Python bindings came from your Linux distribution rather than PyPI, take the fix through the distribution instead.

• Upstream Brotli: 1.0.10, 1.1.1 or 1.2.1, depending on your branch.
• Node.js: 22.23.4, 24.22.1, 26.12.1.
• Python: brotli 1.2.1, brotlicffi 1.2.1.0.
• .NET: 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3. Framework-dependent applications need the updated runtime and a restart; self-contained applications need rebuilding and republishing.
• Bun: 1.4.4, reported by Tanium; check Bun's own advisory (GHSA-663w-cv8g-jj2p) for confirmation. Applications compiled into standalone Bun executables keep the old decoder until rebuilt.
• Envoy and Istio: see their security advisories GHSA-3wvj-j6qm-62mr and istio-security-2026-007 for the fixed release in your series.
• Debian: fixed Brotli library packages for bookworm and trixie, per Debian's security tracker.

python3 -m pip install --upgrade "brotli>=1.2.1"

python3 -m pip install --upgrade "brotlicffi>=1.2.1.0"

If you cannot patch yet

There is no vendor workaround in the Node.js advisory; upgrading is the remedy. Red Hat's bulletin lists stop-gap measures for services that cannot be updated immediately, and Wiz and Rapid7 give similar advice. They reduce exposure but do not replace the update.

Limit which untrusted clients can reach services that decompress Brotli, and restrict their network access. At a reverse proxy or load balancer you control, strip or reject requests carrying a Content-Encoding of br from untrusted clients. In Node.js applications, avoid zlib.brotliDecompress() and zlib.createBrotliDecompress() on untrusted data. If your application fetches content from sites you do not control, find out whether its HTTP client accepts Brotli and whether that can be turned off. We cannot give you a safe one-line setting for that, because it differs by library; check your client's documentation and test it first. Review web application firewall, application and network logs for unusual Brotli traffic and for unexplained crashes or restarts of the affected services.

What is known about exploitation

CISA's KEV listing on 27 October 2026 is the authority for saying the vulnerability is being exploited. The public record does not yet tell us who is exploiting it, what products they targeted or how successful they were, and we have found no organisation that has publicly confirmed being affected through this CVE. We are not naming any.

Before the listing, researchers had publicly shown crashes on stock Node.js. Tanium reports that Imperva demonstrated attacker-controlled code execution on an unmodified Node.js 24.22.0 image, though only after several attempts, and that researchers disagree about how reliably the memory write can be reached. Treat that as evidence the flaw is exploitable, not as a prediction of what any attacker can do to your particular service. Public proof-of-concept code for headline vulnerabilities is also a known route for malware, so do not download or run exploit repositories to test your own systems.

Patching closes the hole but does not tell you whether it was used. If an internet-facing service you could not update has crashed repeatedly, behaved oddly or shown unexpected processes since the Node.js release on 21 October, involve whoever handles your incident response.