Google's Brotli compression library has an out-of-bounds write in its decoder that is now on CISA's exploited-in-the-wild list. The problem is not the library on its own: Brotli is compiled into Node.js, .NET, PowerShell 7 and dozens of other tools, so the fix has to be applied to each runtime separately.
What happened
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October 2026 with a remediation deadline of 10 November for US federal agencies. NVD scores it 9.8 under CVSS 3.1; Google, which is the CNA for Brotli, scored it 9.2 under CVSS 4.0.
The bug is an out-of-bounds write in the decoder. A crafted compressed stream is not rejected, so the unpacking routine keeps writing past the buffer it was given. That can crash the process, leak memory contents, or give an attacker control of execution. Unpacking happens early, usually before authentication, so no credentials are needed to reach it.
The exploitation evidence is thin but real. Security firm ELLIO reported sensors catching a first payload aimed at the official Node.js 24.22.0 build for x86-64, and in its own testing the chain crashed the process rather than opening a shell. CISA has not named a victim or published its evidence. Two firms have logged attempts against honeypots.
Who is affected
Any software that decompresses untrusted Brotli data with versions 1.0.3 through 1.2.0. Practical exposure depends on whether the application actually decodes Brotli, and often on whether that was switched on by default.
- Node.js: 20.x, 22.x, 23.x, 24.x, 25.x and 26.x are affected. Fixed in 22.23.4, 24.22.1 and 26.12.1. Lines 20, 23 and 25 are end of life and will get no fix.
- Microsoft .NET 8, 9, 10 and 11 RC, fixed in 8.0.33, 9.0.22, 10.0.14 and RC3. ASP.NET Core request decompression and HttpClient automatic decompression are off by default. The legacy .NET Framework shipped with Windows is not affected.
- PowerShell 7, fixed in 7.4.22, 7.5.13 and 7.6.9. Here automatic response decompression is on by default for Invoke-WebRequest and Invoke-RestMethod.
- PHP for Windows builds (8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1), Git for Windows 2.56.0.windows.4, Visual Studio, Bun 1.4.4, Python brotli 1.2.1 and Go's andybalholm/brotli 1.2.7.
- Envoy Proxy and Istio, but only where a Brotli decompressor is configured. The compressor alone is not an entry point.
What to do now
Patch by updating the runtime that does the decompression, then restart or redeploy it. Upgrading the Node.js source package or the operating system's libbrotli alone will not fix a binary that carries its own copy.
- Move every Node.js service to 22.23.4, 24.22.1 or 26.12.1, including Node bundled inside container images, Electron builds, CI runners and local development.
- Install .NET 8.0.33, 9.0.22 or 10.0.14. For self-contained and Native AOT apps, rebuild and republish against the new SDK. For containers, rebuild on the new base images. Windows Update will not deliver these unless Microsoft Update is enabled.
- Update PowerShell 7 to 7.4.22, 7.5.13 or 7.6.9 wherever it was installed, not only on the machine you are sitting at.
- Where patching will take time, stop the affected application from accepting or fetching Brotli content from untrusted sources until it is fixed.
- Check the runtime version inside each running container, not on your workstation. A build host on a patched version says nothing about what is deployed.
What this means for South African businesses
Most South African SMEs do not think of themselves as running Node.js, but they do: the hosting panel, the invoicing integration, the internal dashboard and the API between the CRM and the accounting system are frequently built on it, and often deployed in containers nobody rebuilt since the last project. The 10 November deadline is a US federal date, not a local one, but the exposure window is the same.
In my view the risk here is concentrated in exactly the places SMEs do not inventory, which is the middleware between the website and the business system. A Node service that decompresses a request body, or fetches a compressed response from a third party, is reachable without any credentials.
Source
Microsoft Security Response Center guidance, 30 October 2026: Patch now: PHP2Shell, Brotli and eMudhra guidance for customers.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.