CVE-2026-111497 – Brotli: Memory Error During Decompression Enables Code Execution

What happened?

Brotli is a compression format that web servers and browsers commonly use for transfers (Content-Encoding: br). On October 21, Google closed a vulnerability in the decoder. When the decoder failed to recognize an invalid data stream as an error, it wrote data past the end of an internal buffer.

With crafted data, an attacker can crash the process, read memory contents or run their own code. They need neither an account nor any help from a user. Google rates the vulnerability at CVSS 9.2, Node.js rates it High. No attacks are known so far.

Who is affected?

• ▸Node.js 22, 24 and 26 before 22.23.4, 24.22.1 and 26.12.1 respectively. The flaw is reachable as soon as an application decompresses Brotli data from outside. This often happens automatically: fetch() and axios decompress Brotli responses on their own, and Express 5 also decompresses compressed requests. Services that fetch URLs supplied by users, for example for webhooks or link previews, are most at risk.
• ▸Linux servers with the brotli or libbrotli package. Debian has already released fixed packages.
• ▸Software with its own copy of Brotli, for example the Perl module IO::Compress::Brotli (CVE-2026-115936).
• ▸Node.js 20 and 25 no longer receive a fix.

What needs to be done?

1. ▸Update Node.js: Install 22.23.4, 24.22.1 or 26.12.1 and restart running processes. Migrate older versions to Node.js 22 or 24.
2. ▸Update system packages: Apply your distribution's Brotli updates and restart the affected services. Container images need to be rebuilt.
3. ▸Check bundled copies: If an application ships its own Brotli, update it to a version with Brotli 1.0.10, 1.1.1 or 1.2.1.
4. ▸If you can't update right away: Don't decompress Brotli data from untrusted sources. In HTTP clients, you can turn off Brotli by offering only gzip in the Accept-Encoding header.

---

This advisory is for informational purposes. For support in reviewing your applications and servers, contact us.