Who this is for: developers and operators running web services, APIs, crawlers or batch jobs on Node.js, Bun, Python or .NET. This article is based on public information from Google's Brotli project, Node.js, Microsoft, PyPI, JPCERT/CC and US government sources. It does not cover attack steps or exploit code.
Developing: this page will be updated as more is published
As of 23:00 UTC, October 26, 2026Not yet known
- Whether it is exploited (no primary source reports it)
- NVD's own assessment (awaiting analysis)
- The full list of affected products
- Some Linux distributions (older releases not yet assessed)
Google published fixes on October 21 (US time), Node.js the same day, and Microsoft on October 25 (US time). JPCERT/CC issued an alert on October 26. CISA's KEV catalog does not list the flaw. More vendors are still shipping fixes, so this page will be updated as they publish.
What to do today
Check whether you decompress Brotli data from outside
Examples are a web server that decompresses requests sent with Content-Encoding: br, an HTTP client that automatically decompresses responses from external sites, and code that decompresses files users upload. If any of these apply, treat this as urgent (this site's view).
Check the versions of your runtimes and packages
Use the commands in "How to check whether you are affected" below to check Node.js, Bun, the Python packages, and the .NET runtime and SDK.
Update to a fixed version
Update to at least the versions in "Fixed versions" below. Official nodejs.org builds of Node.js 20.x and older are out of support and get no fix, so move to 22.x or later. For Node.js installed from Ubuntu or Debian packages, follow the distribution's security notice.
Rebuild, redeploy and restart
Rebuild container images, executables made with bun build --compile, and .NET self-contained or NativeAOT apps with the fixed versions, then redeploy them. Restart running processes too: an old process keeps the old library loaded.
Check for signs of compromise
JPCERT/CC asks users to check for compromise as well as apply fixes. Look for increased crashes, unfamiliar child processes or outbound connections in processes that decompress data from outside (this site's suggestion).
Fix pins in lockfiles and base images
If package-lock.json, requirements.txt, poetry.lock or the FROM line of a Dockerfile pins an old version, the next build will bring it back. Change the pins to fixed versions.
Fixed versions
| What you use | Affected | Fixed in | Source |
|---|---|---|---|
| Brotli (C library) | 1.0.3–1.0.9, 1.1.0, 1.2.0 | 1.0.10, 1.1.1, 1.2.1 | |
| Node.js 22.x | before 22.23.4 | 22.23.4 | Node.js |
| Node.js 24.x | before 24.22.1 | 24.22.1 | Node.js |
| Node.js 26.x | before 26.12.1 | 26.12.1 | Node.js |
| Node.js 20.x and older (official nodejs.org builds) | end of life | none (move to 22.x or later) | Node.js |
| Bun | 1.0.21 up to before 1.4.4 | 1.4.4 | Bun |
| PyPI brotli | 1.0.3 up to before 1.2.1 | 1.2.1 | GitHub Advisory Database |
| PyPI brotlicffi | 1.0.3 up to before 1.2.1.0 | 1.2.1.0 | GitHub Advisory Database |
| .NET 8 | before 8.0.33 | runtime 8.0.33 (SDK 8.0.133, 8.0.427) | Microsoft |
| .NET 9 | before 9.0.22 | runtime 9.0.22 (SDK 9.0.123, 9.0.320) | Microsoft |
| .NET 10 | before 10.0.14 | runtime 10.0.14 (SDK 10.0.114, 10.0.403) | Microsoft |
| Envoy | v1.39.2, v1.38.5, v1.37.7, v1.36.11 | v1.40.0, v1.39.3, v1.38.6, v1.37.8, v1.36.12 | Envoy |
| PHP Windows builds | 8.5.12, 8.4.27, 8.3.36, 8.2.35 before the rebuild | 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1 | PHP |
.NET Framework is not affected (Microsoft). A fix is also available for .NET 11 previews (11.0.0-rc.3.26522.148). According to Envoy, deployments are affected only if they have the Brotli decompressor configured.
Linux distributions often backport the fix without changing the upstream version number. For example, Ubuntu 22.04's brotli is fixed in "1.0.9-2ubuntu0.1", which still says 1.0.9. For OS packages, go by your distribution's security notice, not by the version number alone.
According to the PHP team, PHP Windows builds are exposed through the cURL extension when automatic HTTP response decompression is enabled (it is off by default in cURL, but applications and HTTP client libraries can turn it on). The fixed builds carry a "-1" suffix; the PHP version itself does not change.
OS library (libbrotli)
Fixed by OS updates. Restart processes that use it
Bundled in a runtime (Node.js, Bun, .NET)
Update the runtime itself
Language packages (brotli, brotlicffi)
Update in every virtual environment
Things you built (containers, executables)
Rebuild with fixed versions and redeploy
How to check whether you are affected
These commands only check versions on your own systems.
Node.js
Run node -v. Versions before 22.23.4, 24.22.1 or 26.12.1 are affected. node -p process.versions.brotli shows the bundled Brotli version, but depending on how a fix is applied that number may not change, so decide by the Node.js version itself (this site's view). For Docker, check inside the image, for example docker run --rm --entrypoint node <image> -v. Node.js installed from Ubuntu or Debian packages uses the system libbrotli, so check it as described under “OS libraries” below.
Bun
Run bun --version. Versions before 1.4.4 are affected. Executables built with bun build --compile include the Bun they were built with and stay affected until rebuilt (Bun's advisory).
Python
Run pip show brotli brotlicffi (or look for Brotli and brotlicffi in python -m pip list). brotli before 1.2.1 and brotlicffi before 1.2.1.0 are affected. If neither is installed, there is no Python package to fix for this flaw. Each virtual environment and container has its own copy, so check each one. If it came from an OS package such as python3-brotli, go by your distribution's security notice, not the version number.
.NET
Run dotnet --list-runtimes and dotnet --list-sdks. Microsoft says you are exposed if you enabled Brotli in ASP.NET Core request decompression or HttpClient automatic response decompression, or call BrotliStream or BrotliDecoder directly. Neither automatic option is on by default.
OS libraries
Check the installed version with dpkg -l 'libbrotli*' on Debian and Ubuntu, rpm -qa 'brotli*' 'libbrotli*' on RHEL-based systems, or apk list --installed 'brotli*' on Alpine, and compare it with your distribution's security notice. Debian fixed Debian 12 in 1.0.9-2+deb12u1 (DLA-4855-1) and Debian 13 in 1.1.0-2+deb13u1 (DSA-6582-1).
What was disclosed
- CVE
- CVE-2026-111497 (GitHub advisory GHSA-9v8h-qqgm-4m35)
- Type
- Out-of-bounds write (CWE-787) and unchecked return value (CWE-252) in the Brotli decoder (c/dec/decode.c)
- Severity
- CVSS v4.0 9.2 (Google). Network attack vector, no authentication, no user interaction, attack requirements present (AT:P). Microsoft rates the .NET issue 8.1 under CVSS v3.1
- Impact
- Decompressing a crafted Brotli stream can corrupt adjacent memory, disclose memory contents, cause denial of service, or potentially allow arbitrary code execution (Google's description on NVD). For .NET, Microsoft says it could lead to information disclosure, denial of service or elevation of privilege (it does not mention code execution)
- Affected
- Brotli 1.0.3–1.0.9, 1.1.0 and 1.2.0, and products that bundle it
- Fixed
- Brotli 1.0.10, 1.1.1, 1.2.1 (October 21, 2026, US time)
- Workaround
- Google provides none (JPCERT/CC). Microsoft says to avoid decompressing attacker-controlled Brotli data until you can update
According to Node.js, the decoder treated an invalid block switch in malformed data as a temporary need for more input rather than a format error, so it kept writing past the end of an internal eight-byte buffer. In Node.js, applications that decompress attacker-supplied Brotli data with node:zlib are affected. Node.js rates the issue High. The same releases fix nine other vulnerabilities.
According to Bun's advisory, Bun's fetch decompresses Brotli responses automatically by default, so the server an application connects to, or an attacker on the path of an unencrypted connection, can supply the data.
An OS update alone may not fix it
Brotli is bundled as a copy inside many programs, including Node.js, Bun, the Python Brotli packages, .NET and Envoy. JPCERT/CC asks users whose applications decompress Brotli data to check each vendor's latest information for impact and fix status. Microsoft also says updating the shared runtime does not fix NativeAOT apps; they must be republished.
Exploitation and proof-of-concept status
As of the morning of October 27 (Japan time), Google, Node.js, Microsoft and JPCERT/CC report no exploitation in the wild. CISA's KEV catalog (October 26 version) does not list the flaw. CISA's SSVC assessment added to NVD on October 23 rates exploitation as none, automatable as no, and technical impact as total. Microsoft's CVSS rates exploit code maturity as unproven.
Primary sources do not mention a public proof of concept. An independent explainer site says one was published on October 22: on standard builds it only causes a crash and a limited memory read, while on a deliberately weakened build it reaches code execution. The same site says a security company's research team achieved code execution on an official Node.js image without releasing the method. This site has not verified any of this and does not link to it.
Ubuntu rates the issue Medium priority, while Google rates it 9.2. Which matters more for you depends on whether you decompress data received from outside (this site's view).
About the main Python HTTP libraries
As of October 27, requests, urllib3, httpx and aiohttp have not published advisories for this flaw (this site checked each repository's security advisory list). urllib3, httpx and aiohttp treat brotli or brotlicffi as optional extras and decompress Brotli only when one of them is installed. The packages to fix are brotli and brotlicffi in the same environment. Updating the HTTP library alone does not help if brotli stays old.
What is not yet known
| Item | Status |
|---|---|
| Exploitation in the wild | Not reported by primary sources. Not in KEV |
| Public proof of concept | Not mentioned by primary sources. An independent site says one exists (unverified) |
| NVD assessment | Awaiting analysis (only Google's 9.2) |
| Full list of affected products | Still growing. For browsers and other products, check each vendor's notice |
| Linux distributions | Ubuntu 20.04 and older not yet assessed |
Sources
All checked on October 27, 2026.
- JPCERT/CC, alert on the Brotli out-of-bounds write (CVE-2026-111497) (JPCERT-AT-2026-0034, October 26, 2026, Japanese) — jpcert.or.jp
- PHP, "Updated PHP Windows builds for Brotli security fix" (October 26, 2026) — php.net
- Google Brotli releases v1.2.1, v1.1.1, v1.0.10 (October 21, 2026) — v1.2.1 / v1.1.1 / v1.0.10
- Node.js, "Node.js Security Releases" (October 21, 2026) — nodejs.org
- Microsoft, "Microsoft Security Advisory CVE-2026-111497 | .NET Brotli Decoder Out-of-bounds Write Vulnerability" (October 25, 2026) — github.com/dotnet
- GitHub Advisory Database GHSA-9v8h-qqgm-4m35 (PyPI brotli and brotlicffi) — github.com
- PyPI brotli 1.2.1 — pypi.org / brotlicffi 1.2.1.0 — pypi.org
- Bun, "Bundled brotli decoder has an out-of-bounds write" (GHSA-663w-cv8g-jj2p, October 23, 2026) — github.com
- Envoy, "Out-of-Bounds Write in Brotli Decompressor" (GHSA-3wvj-j6qm-62mr, October 23, 2026) — github.com
- NVD, "CVE-2026-111497" — nvd.nist.gov
- CISA, "Known Exploited Vulnerabilities Catalog" (not listed in the October 26 version) — cisa.gov
- Ubuntu, "CVE-2026-111497" — ubuntu.com / Debian, "DLA-4855-1 brotli" — lists.debian.org
Update history
2026-10-27: First version, based on public information from Google, Node.js, Microsoft, Bun, Envoy, PHP, PyPI, JPCERT/CC, NVD, CISA's KEV catalog, Ubuntu and Debian.
Read next
- Deciding priority: Deciding what to patch first: CVSS, EPSS and KEV
- When a vulnerability is announced: CVE remediation playbook
- Auditing dependencies: Auditing dependencies with OSV-Scanner
- Another critical fix the same week: PHP flaws CVE-2026-109618 and CVE-2026-109619
- Another Python dependency update the same month: eMudhra certificates: updating pip, certifi and uv
- Terms: What is RCE (remote code execution) / What is CVSS