CVE-2026-111497: google brotli, nodejs node.js, python-hyper brotlicffi

CVSS 9.8 (critical) · listed as exploited by CISA since 2026-10-27 · published 2026-10-22

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Affected products (NVD): google brotli, nodejs node.js, python-hyper brotlicffi, microsoft .net, debian debian_linux, istio istio, anthropic bun, envoyproxy envoy, tianocore edk2, google woff2, duckdb duckdb, clickhouse clickhouse, apache arrow, mcmilk 7-zip-zstd, 7-zip p7zip, andybalholm brotli, siemens ruggedcom_ape1808_firmware, siemens common_configurator, siemens data_flow_monitoring, siemens dataxess_configurator

Fixed in (NVD): 1.0.10, 1.1.1, 1.2.1, 22.23.4, 24.22.1, 26.12.1, 1.2.1.0, 8.0.33, 9.0.22, 10.0.14, 1.29.9, 1.30.6, 1.31.2, 1.4.4, 1.37.8, 1.38.6, 1.39.3, 1.2.7, 3.0.18, 1.5.7

Weakness: CWE-252, CWE-787

Source: NVD CVE-2026-111497

References

• https://github.com/andybalholm/brotli/releases/tag/v1.2.7
• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
• http://www.openwall.com/lists/oss-security/2026/10/23/25
• http://www.openwall.com/lists/oss-security/2026/10/24/6
• http://www.openwall.com/lists/oss-security/2026/10/26/12
• http://www.openwall.com/lists/oss-security/2026/10/26/13
• http://www.openwall.com/lists/oss-security/2026/10/26/16
• http://www.openwall.com/lists/oss-security/2026/11/03/2
• https://broccoli2shell.com
• https://github.com/advisories/GHSA-9v8h-qqgm-4m35

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.