Overview
- Security teams disclosed CVE-2026-111497 after OpenAI Codex Security identified an out‑of‑bounds write in the Brotli C decoder that can corrupt memory, leak data, crash processes, or in some cases enable remote code execution.
- Vendors moved quickly to patch the issue with upstream Brotli releases and downstream updates, with stable fixes published between Oct. 21 and Oct. 23 and emergency updates from Microsoft, Node.js, Python packages and PHP arriving later in the week.
- Proof‑of‑concept exploits and a demonstration by Imperva showing code execution against a specific Node.js 24.22.0 Linux arm64 image exist, but there are no confirmed reports of widescale exploitation in real networks.
- Effective remediation requires more than installing library updates: teams must inventory where Brotli is bundled, update affected runtimes, restart processes, and rebuild and redeploy container images so the patched code is actually loaded.
- Organizations are urged to prioritize internet‑facing services that decompress untrusted 'br' data, use temporary mitigations such as disabling Brotli decoding or blocking 'br' requests at the perimeter, and monitor for crashes or unusual decompression activity as they apply fixes.