CVE-2026-111497: Google Brotli Decoder Out-of-Bounds Write RCE (KEV)

CVE-2026-111497 is a buffer overflow in the Brotli decompression library that lets a remote, unauthenticated attacker corrupt memory, leak data, crash a process or potentially execute code just by having it decompress a crafted Brotli stream, and because Brotli is bundled inside Node.js and many other runtimes this is reachable through any application that decompresses untrusted Brotli input, including via standard HTTP Content-Encoding handling; CISA added it to KEV the same day covered here.

CVE-2026-111497 is a buffer overflow (CWE-787, with an unchecked-return-value root cause, CWE-252) in the Brotli decoder's c/dec/decode.c. NVD's description states it affects Brotli "versions 1.0.3 through 1.2.0 on all platforms" and "allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream" (NVD).

As of 2026-10-27, NVD's own vulnerability status for this CVE is still "Undergoing Analysis" — NVD has not yet published its own CVSS score. The Google CNA has submitted a CVSS v4.0 score of 9.2 (critical), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; the GitHub Security Advisory for the affected PyPI packages lists the same 9.2 critical rating. That score is the CNA's own submission, not an NVD-confirmed figure, so it is reported here as context rather than as this page's cvss_score (NVD; GitHub Security Advisory GHSA-9v8h-qqgm-4m35).

Google's upstream fix is Brotli 1.2.1 (with 1.0.10 and 1.1.1 also carrying the fix for older maintained branches); the GitHub Security Advisory for the Python bindings lists brotli fixed at 1.2.1 and brotlicffi fixed at 1.2.1.0 (Google Brotli release v1.2.1; GitHub Security Advisory GHSA-9v8h-qqgm-4m35).

Because Brotli ships bundled inside Node.js and is reachable through node:zlib (and transparently via standard HTTP Content-Encoding: br decompression), the Node.js project shipped its own out-of-cycle fix. Node's advisory rates it "HIGH" severity and explains the mechanism: "An invalid block switch was reported as a temporary need for more input instead of a permanent format error," causing "the streaming decoder to keep appending input bytes to an eight-byte internal buffer," so "an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory," with impact ranging from a process crash to memory disclosure to remote code execution. Fixed versions are Node.js 22.23.4, 24.22.1 and 26.12.1 (Node.js, October 2026 security releases).

CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-27, with a required-action due date of 2026-11-10; CISA's KEV notes flag it as affecting "an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products" rather than a single vendor product (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.55483 (99.03th percentile) (FIRST EPSS).

Because this is a library-level flaw reachable through ordinary decompression of attacker-supplied data, every application that links an affected Brotli build (1.0.3–1.2.0) or an affected Node.js runtime (22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1) should upgrade immediately, not just internet-facing servers — any code path that decompresses untrusted Brotli data is exposed, and this one is already on KEV.

• Buffer overflow in Brotli decoder (c/dec/decode.c), versions 1.0.3-1.2.0, allows a remote unauthenticated attacker to corrupt memory, disclose data, cause DoS, or potentially execute arbitrary code via a crafted Brotli-compressed stream. — NVD
• NVD vulnerability status is 'Undergoing Analysis' as of 2026-10-27, with no NVD-published CVSS score; the Google CNA submitted CVSS v4.0 9.2 (critical), not NVD-confirmed. — NVD
• Fixed upstream in Brotli 1.2.1 (also backported to 1.0.10 and 1.1.1); Python bindings brotli fixed at 1.2.1 and brotlicffi fixed at 1.2.1.0. — GitHub Security Advisory GHSA-9v8h-qqgm-4m35
• Node.js bundles the affected Brotli decoder, reachable via node:zlib; rated HIGH severity by the Node.js project, fixed in Node.js 22.23.4, 24.22.1 and 26.12.1. — Node.js, October 2026 security releases
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-27, due date 2026-11-10, flagged as affecting an open-source component usable by many products. — CISA KEV
• EPSS score is 0.55483 (99.03th percentile) as of 2026-10-27. — FIRST EPSS