Out-of-bounds write in Google Brotli decoder enables remote code execution via a crafted compressed stream (CVE-2026-111497)
CISA added this to KEV on 2026-10-27 with public exploits already in VulnCheck XDB and emergency fixes shipped by Node.js, Microsoft .NET and PHP, so a service that still decodes Brotli content from the network with an unpatched library can be taken over by a single crafted request or response.
An unchecked return value in Google's Brotli decoder lets a crafted Brotli-compressed stream corrupt adjacent decoder state, leaking memory or executing arbitrary code in any process that decompresses attacker-supplied Brotli data without authentication. The decoder ships inside Node.js, .NET, the PHP cURL extension, Bun, Envoy Proxy, Istio and Python HTTP clients, so HTTP servers and clients that accept Brotli-encoded bodies are reachable targets.
Affected: Google Brotli 1.0.3 to before 1.0.10; Google Brotli 1.1.0 to before 1.1.1; Google Brotli 1.2.0 to before 1.2.1; Node.js 26.x, 24.x and 22.x release lines before the October 21, 2026 security releases; Microsoft .NET builds before the emergency Brotli security updates; PHP 8.2 through 8.5 official Windows packages before the rebuilt packages; andybalholm/brotli (Go) before v1.2.7; Debian packages covered by the October 2026 debian-lts-announce msg00049 update
How to Test
Inventory every component that links the Brotli decoder: check the system libbrotli version against 1.0.10 / 1.1.1 / 1.2.1 for its branch; compare installed Node.js against the 26.x, 24.x and 22.x builds from the October 21, 2026 security release; confirm the emergency .NET security update is installed; on Windows confirm PHP 8.2–8.5 is running the rebuilt packages; check Go modules for andybalholm/brotli below v1.2.7; and review Envoy, Istio, Bun and Python HTTP client deployments for their bundled decoder version. To look for prior abuse, review crash logs and core dumps from processes that decode Brotli, and inspect access logs for unusual Brotli-compressed request or response bodies hitting endpoints that decompress them.
How to Patch
Upgrade libbrotli to 1.0.10, 1.1.1 or 1.2.1 depending on branch; apply the Node.js October 21, 2026 security releases for the 26.x, 24.x and 22.x lines; install Microsoft's emergency .NET security updates; replace PHP 8.2–8.5 Windows packages with the rebuilt releases; upgrade andybalholm/brotli to v1.2.7; apply the Debian LTS update from debian-lts-announce 2026/10/msg00049. Where an upgrade must wait, disable Brotli content decoding in the affected application or proxy so untrusted Brotli streams are not decompressed.