CVE-2026-111497 in Google Brotli is on CISA's exploited list. See which versions are affected, the fixed releases and how to check your systems.
Brotli is a compression library from Google, built into many kinds of software, from web servers to language runtimes. A flaw in it affects every product that uses it. CVE-2026-111497 (a Common Vulnerabilities and Exposures identifier) is such a flaw, and CISA has now added it to its list of actively exploited vulnerabilities.
Short answer: CVE-2026-111497 is a critical buffer overflow (CVSS score 9.2, the Common Vulnerability Scoring System) in the decoder of Google’s Brotli library. According to NVD, versions 1.0.3 through 1.2.0 are affected, and the fixed releases are 1.0.10, 1.1.1 and 1.2.1. CISA added it to the KEV catalog on October 27, 2026, with a deadline of November 10, 2026. If you use Brotli in your code, your packages or your runtimes, check each one and update it.
What happened?
The flaw is a buffer overflow in the Brotli decoder (the c/dec/decode.c file). When an attacker sends a specially crafted Brotli-compressed stream, the memory next to the decoder can be corrupted. According to the NVD description, the attack is remote and requires no authentication. Its outcomes include leaking memory contents, denial of service and, potentially, arbitrary code execution.
The weakness is classified as CWE-252, an unchecked return value. NVD and the GitHub advisory use this. CISA’s KEV entry also lists CWE-787 (writing outside a memory buffer’s bounds), which matches the “buffer overflow” wording. The sources do not classify it identically.
CISA added this flaw to the Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, which means it is confirmed to be used in real attacks. Its ransomware use is marked “Unknown” in KEV. The flaw is recent: it was published on October 22, 2026.
Node.js and .NET have also published bulletins for the same CVE, which shows how far the flaw reaches.
Who is affected?
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-111497 |
| Product | Google Brotli (C library) |
| CVSS score | 9.2 (CVSS 4.0, NVD) |
| Severity | Critical |
| Weakness type (CWE) | CWE-252 (NVD, GitHub); KEV also lists CWE-787 |
| Published | October 22, 2026 |
| Added to CISA KEV | October 27, 2026 |
| CISA due date | November 10, 2026 |
| Affected Brotli versions | 1.0.3 through 1.2.0 (inclusive) |
| Fixed Brotli versions | 1.0.10, 1.1.1, 1.2.1 |
| PyPI brotli | Affected from 1.0.3 before 1.2.1; fixed in 1.2.1 |
| PyPI brotlicffi | Affected from 1.0.3 before 1.2.1.0; fixed in 1.2.1.0 |
| Node.js | Lines 22.x, 24.x and 26.x affected; releases 22.23.4, 24.22.1 and 26.12.1 published |
| .NET | Affected before 8.0.33, 9.0.22 and 10.0.14; these versions are fixed |
The Node.js bulletin does not explicitly map which release contains this fix, so check it yourself before relying on a version.
Distributions such as Debian, Ubuntu and RHEL can backport fixes without changing the version number, so check your distribution’s security advisory.
What should you do?
- Find where Brotli is used. Check your code, dependencies and runtimes. It often arrives as a dependency you never added directly. For a general server check, see First 30 minutes on a Linux server.
- Check the version.
- Debian/Ubuntu:
dpkg -l | grep -i brotli - RHEL and its derivatives:
rpm -qa | grep -i brotli - Python:
pip show brotliandpip show brotlicffi - Node.js: run
node -vand compare the result with the lines above - .NET:
dotnet --list-runtimes
- Debian/Ubuntu:
- Update. If you built Brotli yourself or copied it into a project, move to 1.0.10, 1.1.1 or 1.2.1. If you use a distribution or runtime package, confirm in the vendor’s bulletin that the fix is included.
- Workarounds. The sources do not confirm a workaround. Check NVD and the relevant vendor bulletins for any additional steps.
- If you cannot update right away. The CISA KEV entry says that if mitigations are unavailable, you should consider discontinuing use of the product. Plan your update before the November 10, 2026 deadline.
- If you suspect compromise. Tell your system administrator and provider immediately. Do not try to erase traces yourself; preserve the evidence first.
Frequently asked questions
Does this affect me?
You may be affected even if you never installed Brotli directly, because other software may bundle it. Run the version checks above, and read the Node.js or .NET bulletins if you use them.
CVSS is 9.2 here but the .NET bulletin says 8.1. Which is right?
Both come from different scoring systems: NVD uses CVSS 4.0 (9.2), and the .NET bulletin uses CVSS 3.1 (8.1). Both are high or critical, so neither is a reason to lower your priority.
What if I cannot update immediately?
The CISA KEV entry suggests considering discontinuing the product when no mitigation is available. Plan your update around the November 10, 2026 due date.
This article was prepared on November 6, 2026 based on CISA and NVD records. It will be updated if new information appears. For server and application updates and ongoing security maintenance, you can reach me through the quote form.