CISA Adds Brotli CVE-2026-111497 to Vulnerabilities with Recorded Exploitation

On October 27, 2026, the Brotli CVE-2026-111497 vulnerability was added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. The listing means the agency has recorded its exploitation. U.S. federal civilian agencies must address the issue by November 10, 2026.

The vulnerability is located in the Google Brotli decoder and involves an out-of-bounds write to allocated memory. It occurs when specially crafted compressed input is processed. The risk affects applications that decompress attacker-controlled Brotli data.

Brotli CVE-2026-111497: Where Fixes Are Available

The upstream Google Brotli project released fixes in versions 1.0.10, 1.1.1, and 1.2.1. Organizations should therefore check not only the system library version, but also copies of Brotli bundled directly with applications, runtime environments, or third-party products.

Node.js also confirmed the impact. The 22.x, 24.x, and 26.x branches are affected, and fixed releases are now available:

• Node.js 22.23.4,
• Node.js 24.22.1,
• Node.js 26.12.1.

For Node.js operators, this means updating the runtime to the relevant fixed version. For other products, follow their vendor’s security guidance, as they may use their own statically bundled copy of the library.

KEV Raises the Priority of Inventory Checks

The KEV catalog serves as a list of vulnerabilities whose exploitation CISA has recorded. In the case of CVE-2026-111497, this is therefore not merely a vulnerability tracked as part of the regular update-management process. Organizations should check where they process untrusted Brotli responses, requests, or files.

Brotli is used for data compression and may be part of runtime environments, HTTP clients, servers, or security products. The most relevant paths are those where an application automatically or explicitly decompresses input supplied from outside.

If an immediate update is not possible, a known mitigation is to restrict the decompression of untrusted Brotli input where the product or application allows it. However, this option depends on the specific deployment and configuration.

Technical Attack Details Still Unavailable

CISA has not published technical details about the active exploitation, its scope, or attribution to specific attackers. It has also not been confirmed which products or deployments beyond those covered by already published vendor advisories were affected in the attacks.

The confirmed property of the vulnerability is memory corruption during the decompression of attacker-prepared data. Specific consequences, including the possibility of remote code execution, depend on the application, input path, compilation, and security mechanisms in use.

Further developments will depend on new information from CISA or trusted researchers about the exploitation technique and targets. Additional advisories from vendors whose products contain their own copy of Brotli will also be important.

Verified and updated: October 28, 2026 06:22