Overview
- Security teams are tracking CVE-2026-111497, an out‑of‑bounds write in the Brotli decoder that can crash processes, leak memory, or in some builds allow unauthenticated remote code execution.
- The flaw reaches many ecosystems that embed or bundle Brotli, including Node.js, Python Brotli packages, Bun, Envoy, Istio, .NET, and frameworks that auto‑decompress HTTP content.
- Vendor response accelerated this week with stable fixes and advisories released between October 21 and October 26 and Microsoft shipping out‑of‑band .NET and PowerShell updates on October 25.
- Researchers published proof‑of‑concept code and Imperva demonstrated code execution against an official Node.js 24.22.0 Linux arm64 image, though some experts say reliable RCE may depend on specific builds and configs.
- Practical steps for defenders are clear: inventory services that decompress attacker‑controlled Brotli data, upgrade to patched Brotli/runtime versions, restart processes, rebuild and redeploy container images, and block or disable br‑encoded requests until fixes are applied.