Brotli flaw CVE-2026-111497 exploited; Node.js and Cisco fixes

A Brotli decoder flaw, CVE-2026-111497, is being exploited in the wild and sits in the CISA Known Exploited Vulnerabilities (KEV) catalog, with a federal remediation deadline of November 10, 2026 that has already passed. Cisco’s advisory on Node.js and Brotli covers this Brotli bug plus three Node.js TLS and DNS flaws, and the Brotli vulnerability affects Node.js, Google Brotli itself and other software that bundles it.

What happened

On October 21, 2026, Node.js announced fixes for multiple vulnerabilities across its 22.x, 24.x and 26.x release lines. Cisco published its advisory on October 27 and widened its investigation to Brotli outside Node.js on October 30. It lists no workarounds.

The most serious issue is CVE-2026-111497, an out-of-bounds write in the Google Brotli C decoder. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt decoder memory, leak memory contents, crash the process or potentially run code. NVD scores it CVSS 9.2 (critical).

Is the Brotli flaw CVE-2026-111497 exploited?

Yes. CISA added it to KEV on October 27, 2026 as “Google Brotli Unchecked Return Value Vulnerability” and set a due date of November 10, 2026. CISA lists known ransomware campaign use as unknown. Details of the attacks have not been published in the material Cisco or CISA provide.

Am I affected?

Brotli is a compression library that software often bundles or links, so the exposure goes beyond Node.js. NVD lists these among the affected products:

• Google Brotli 1.0.3 up to but not including 1.0.10, 1.1.0 up to 1.1.1, and 1.2.0 up to 1.2.1
• Node.js 22.x, 24.x and 26.x
• andybalholm brotli before 1.2.7, Bun before 1.4.4, Envoy (several branches), ClickHouse up to 26.10.2.103, DuckDB up to 2.0.0, Apache Arrow, p7zip up to 16.02 and Google WOFF2

Cisco says it is still working through which of its products are affected and will update the advisory. Cisco states that a product not listed in the advisory is not affected.

The three Node.js flaws in the same advisory

• CVE-2026-105482 (CVSS 7.4): dns.resolve*() and dns.reverse() silently shorten hostnames at an embedded NUL byte, so a name checked against an allowlist can resolve as a different name. Affects Node.js 26.x, 24.x and 22.x.
• CVE-2026-105483 (CVSS 7.4): tls.checkServerIdentity() does not treat IPv4 hosts written with fullwidth digits as IP addresses, so a certificate with a matching DNS name can be accepted for an IP endpoint. Affects 26.x and 24.x.
• CVE-2026-106069 (CVSS 7.4): a leading-zero IPv4 literal such as 0127.0.0.1 is read as octal for certificate checks but as decimal by some operating system resolvers, such as macOS. Affects 26.x, 24.x and 22.x.

None of these three is listed in KEV.

What to do: how to fix CVE-2026-111497

1. Update Node.js to 22.23.4, 24.22.1 or 26.12.1, per NVD’s fixed-version data.
2. Update standalone Brotli to 1.0.10, 1.1.1 or 1.2.1, and brotlicffi to 1.2.1.0.
3. Update Microsoft .NET to 8.0.33, 9.0.22 or 10.0.14, which NVD also lists as fixed versions.
4. Find software that bundles Brotli, such as proxies, databases, archive tools and web font tooling, and ask each vendor for a patched build. Rebuild containers and vendored dependencies.
5. Check Cisco’s advisory for your Cisco products, since Cisco lists no workarounds.

Why this matters

Analysis, not new facts. A decoder that parses untrusted compressed data is reachable from anywhere that accepts Brotli content: HTTP responses, uploads, API clients and file processing. Because the library is embedded in many products, the hard part is finding every copy of it.

Since the bug is in KEV and the deadline has passed, treat unpatched internet-facing systems as urgent and patch within hours where you can. The three Node.js flaws are lower priority but matter for apps that use allowlists on hostnames or pin TLS identity to IP addresses.

Detection and hunting ideas

• List Node.js runtimes and Brotli library versions across hosts, images and software bills of materials, and flag the vulnerable ranges above.
• Look for unexpected crashes or restarts of services that decode Brotli, such as reverse proxies and Node.js apps, around and after October 21.
• Review outbound connections and child processes spawned by affected services for activity that does not match normal behaviour.

No indicators of compromise have been published. Cisco says it will update the advisory as its investigation continues, with the latest version dated November 12, 2026.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Related coverage

• Cisco Secure Email Gateway SQL injection flaw exploited (CVE-2026-76461)
• Cisco Snort 3 hardening update fixes critical CVE-2026-20043
• Cisco Nexus 9000 ACI contract bypass flaw fixed (CVE-2026-20038)

Sources

• Cisco Security Advisory: Node.js and Brotli, October 2026
• NVD: CVE-2026-111497
• NVD: CVE-2026-105482
• NVD: CVE-2026-105483
• NVD: CVE-2026-106069
• Microsoft .NET announcement
• CISA Known Exploited Vulnerabilities Catalog
• Node.js October 2026 security releases