Brotli Flaw CVE-2026-111497 Now Exploited: Fixed Versions for Node.js, .NET, PAN-OS and Linux

CVE-2026-111497, an out-of-bounds write in Google's Brotli decompression library, lets a crafted compressed stream crash a process, leak memory or potentially run code in software that decodes Brotli data it receives from others, including Node.js, .NET and some Palo Alto firewalls. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October with a 10 November deadline, which binds only US federal civilian agencies. Exploit code has been public on GitHub since 22 October.

The bug

The flaw sits in Brotli's C decoder in versions 1.0.3 through 1.2.0, is fixed in 1.0.10, 1.1.1 and 1.2.1, and is rated 9.2 on CVSS 4.0 in the CVE record. Google published Brotli 1.2.1 on 21 October. Khai Tran and Sylvie Mayer of OpenAI's Codex Security team are credited with finding it.

When the decoder met an invalid block switch, it asked for more input instead of rejecting the stream, according to the Node.js advisory. The streaming decoder then kept appending bytes to an eight-byte internal buffer and wrote past its end.

Who is exposed

Anything that decompresses Brotli data an attacker controls. In Node.js, the security firm ELLIO lists three routes to the decoder:

• request bodies sent with Content-Encoding: br, which Express 5, body-parser 2 and Koa's body parser inflate before any route handler runs;
• responses that HTTP clients decode on their own, including Node's built-in fetch(), axios, got and server-side fetches in Next.js;
• direct node:zlib Brotli calls on data a client supplied.

In Python, urllib3, requests, httpx and aiohttp decode Brotli as soon as a Brotli package is installed. A bare Node.js HTTP server doesn't inflate a Brotli body just by receiving it, and ASP.NET Core and HttpClient don't decompress Brotli by default.

Exploitation

A scanner calling itself node2shell-check probed ELLIO's sensors for hosts that decompress Brotli, and a day later, on 26 October, traffic carrying the public exploit followed. The firm reproduced code execution on the official Node.js 24.22.0 build against four targets, among them Express 5.3.0 and Koa 3. Against a vulnerable test target, the chain captured from attackers never reached a shell in 50 attempts, but each miss crashed the process.

The author of the public exploit calls its Express result "profile specific and probabilistic": it depends on a pinned Node.js 24.22.0 binary, body-parser 2.4.0 and one worker, and tries at most 16 fresh processes. Red Hat says there's "no public, reliable remote code execution proof-of-concept". CISA added the flaw anyway, citing evidence of active exploitation.

Fixed versions

• Node.js: 22.23.4, 24.22.1 and 26.12.1, released 21 October. End-of-life lines stay affected. The same release fixed nine other flaws, covered in the Node.js October security release.
• .NET: 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 RC3, out-of-band on 25 October. PowerShell 7.6.9 followed the same day on an updated .NET SDK.
• Palo Alto Networks PAN-OS: exposed only on firewalls with Brotli inspection and TLS decryption both on, per Palo Alto. Hotfixes 12.2.4-h1, 12.1.7-h11 and 11.2.10-h17 are out, and the remaining 12.1 and 11.2 hotfixes are due by 30 October. PAN-OS 11.1, 10.2 and Panorama aren't affected.
• Python: Brotli 1.2.1 and brotlicffi 1.2.1.0 on PyPI.
• Ubuntu: USN-8956-1 fixes brotli on 22.04, 24.04, 26.04 and 26.10. The nodejs package on 20.04 bundles its own copy and is still listed as vulnerable.
• Debian: DLA-4855-1 fixes bookworm and DSA-6582-1 fixes trixie; forky is still vulnerable.
• Envoy: 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0.
• FrankenPHP: 1.13.4 ships the patched library in its Docker images and Windows builds.

Cisco is still checking which of its products ship the affected Node.js code and hasn't listed any as vulnerable.

What to do

1. Move Node.js that parses request bodies, fetches from outside servers or calls Brotli in node:zlib to the fixed release listed above, internet-facing hosts first, then rebuild container images that embed it.
2. Move .NET apps to the fixed runtime above; until then, ASP.NET Core apps that enabled request decompression can remove the br provider.
3. Install your distribution's brotli update and the fixed Python Brotli or brotlicffi package listed above.
4. On PAN-OS 11.2, 12.1 or 12.2 with Brotli inspection and TLS decryption both on, apply your branch's hotfix as it lands.
5. Check software that bundles its own Brotli, such as Envoy or Bun before 1.4.4, against its vendor's advisory; a system update won't touch those copies.