Small Town Sysadmin
Free CJIS checklist

Networks

Security alert

Brotli decoder flaw is being exploited: check Node.js, .NET and Linux packages

CVE-2026-111497 is a critical memory flaw in the Brotli decompression library that CISA says is exploited. Here is which software carries it, which versions are fixed, and how to check.

On October 27, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog, with a federal due date of November 10. The flaw is in Brotli, a compression library used to unpack web content that was shrunk with the br encoding. A specially built compressed stream can corrupt memory in the program decompressing it.

Brotli is rarely installed on purpose. It rides along inside other software, so most small shops won’t find a product called “Brotli” in their inventory. It matters if you run web applications written in Node.js or .NET, Linux servers, or anything else that decompresses data from outside your network.

What the flaw allows

The bug is in the Brotli decoder. According to the National Vulnerability Database (NVD), a remote attacker with no login can use a crafted stream to corrupt memory, read memory contents, crash the program, or possibly run code. NVD scores it 9.8 out of 10 (CVSS 3.1), and Google’s own CVSS 4.0 score is 9.2. Affected Brotli releases are 1.0.3 up to but not including 1.0.10, 1.1.0 up to but not including 1.1.1, and 1.2.0 up to but not including 1.2.1.

The danger is decompressing data that someone else controls: a web request, a response from a server you don’t run, or an uploaded file. Software that only handles its own Brotli files is not in the same position.

Which software to check

Node.js

The Node.js project fixed this in its October 2026 security releases. Lines 26.x, 24.x and 22.x are affected, and the fixed versions are v26.12.1, v24.22.1 and v22.23.4. An application is at risk if it decompresses attacker-supplied Brotli data with the built-in node:zlib module. Node’s page lists no workaround other than upgrading.

.NET

Microsoft says .NET Framework is not affected. Modern .NET is affected on all platforms in versions before these runtimes:

.NET version Fixed runtime
.NET 8 8.0.33
.NET 9 9.0.22
.NET 10 10.0.14

Having .NET installed isn’t enough to be exposed. The app has to decompress untrusted Brotli data through ASP.NET Core request decompression, HttpClient automatic decompression, or the Brotli classes directly. Install the patched runtime and restart the app. Self-contained and NativeAOT apps carry their own copy, so they must be rebuilt and redeployed; updating the shared runtime doesn’t fix them.

Linux packages

Linux distributions ship Brotli as a package, and other packages may bundle their own. Debian’s security tracker lists a fix for Debian 12 (1.0.9-2+deb12u1) and for Debian 13 (1.1.0-2+deb13u1). At the time of checking, the same tracker still showed Debian’s nodejs packages as vulnerable, so check your distribution’s tracker for every package involved, not only the brotli package.

What to do

  1. List what you run: Node.js applications, .NET 8/9/10 applications, and Linux servers that handle web traffic.
  2. Patch the platform: update Node.js, the .NET runtime, and distribution packages to the fixed versions above.
  3. Restart the services. A running process keeps using the old library until it is restarted.
  4. Rebuild self-contained apps and anything that bundles its own copy.
  5. Ask vendors of web-based products you can’t patch yourself whether they have updated Brotli, and get the answer in writing.

If you can’t patch right away, the .NET advisory says to avoid decompressing attacker-controlled Brotli data, for example by removing the br provider from ASP.NET Core request decompression or DecompressionMethods.Brotli from HttpClient. Test first, and don’t switch on decompression features your app doesn’t already use.

If you were exposed

CISA’s listing doesn’t say who is being attacked or how, so there is no reliable signature to hunt for. If an internet-facing Node.js or .NET application was unpatched, watch it for unexplained crashes and restarts, and treat any unexpected behavior as a possible compromise. Our incident response plan checklist and what to do if you think you’ve been hacked cover the next steps.

This article reflects published information as of October 28, 2026. Check the vendor advisories below for updates.

Sources

All articles