Brotli: a critical flaw in a library found everywhere

On October 28, 2026, the Canadian Centre for Cyber Security published alert AL26-027 on CVE-2026-111497, a critical vulnerability in the Google Brotli compression library. Google had released the fixes on October 21, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 27. Brotli is not a product you install: it is a component built into web servers, language runtimes and proxies. The fix therefore arrives through just as many vendors.

What the sources say

The Canadian Centre for Cyber Security. The alert is aimed at IT professionals and managers. It describes an out-of-bounds write (CWE-787) in the Brotli decoder, exploitable remotely without authentication, which can lead to memory corruption, information disclosure, process crashes or arbitrary code execution. It names the technologies that embed Brotli: Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages, among others, and asks organisations to assess any application that depends on it.

Google, in the Brotli project. Versions 1.0.10, 1.1.1 and 1.2.1 were released on October 21, 2026, each with the same note: "CVE-2026-111497: out-of-bounds write permits remote code execution." The CVE record, published on October 22 by Google as the numbering authority, covers versions 1.0.3 through 1.2.0 and assigns a CVSS 4.0 score of 9.2, critical.

CISA. The KEV entry, added on October 27, 2026, sets a November 10, 2026 due date for US federal agencies and states: "This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products." Known ransomware campaign use is marked "Unknown."

Node.js. The project released versions 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026, fixing the Brotli decoder bundled with Node.js.

Why it matters

A flaw in a product is fixed with one update. A flaw in a library is fixed with as many updates as there are programs that embed it, each on its vendor's schedule. An organisation may never have installed Brotli and still run it in its Node.js application, its Istio service mesh, a PowerShell admin tool or a commercial product that shows it nowhere.

The inventory is also layered. A Python brotli or brotlicffi package may be pinned in a dependency file, a container image may hold a system copy of the library on top of the one inside Node.js, and a commercial product may ship its own. Each copy has its own version and its own path to a fix. Updating the operating system does not fix the copy built into an application, and the reverse is also true.

The fix Google published protects nothing until each vendor has integrated it and you have deployed that vendor's release. In between, the flaw is being exploited: that is what the KEV listing says.

What we think at Sentrix

1. Look for Brotli in your SBOMs, not only on your servers. A software bill of materials lets you answer "where do we run version 1.0.3 through 1.2.0?" in one query. If your vendors do not give you one, our article on what to ask for in an SBOM has the list.
2. Start with what faces the internet. That is the Cyber Centre's priority: web servers, proxies and APIs that receive compressed content from outside.
3. Keep a register of vendor advisories. For each affected product: the affected version, the vendor's advisory, the fixed version and the deployment date. An empty cell is a follow-up to do, not an absence of risk.
4. Patch to the KEV deadline. The October 27 listing triggers the decision now, with a measurable target date, as our vulnerability and patch management service describes, along with our article on prioritizing with the KEV catalog.
5. Document the temporary measure. If a vendor is slow, apply the Cyber Centre's recommendation on untrusted content, with an owner and a review date.

The next step

This week, query your SBOMs and inventories for Brotli, then list the vendors whose fix you are still waiting for. The products with no answer are your priority. If you want to do this exercise with us, contact us.