On 27 October 2026 CISA added CVE-2026-111497, the Google Brotli decoder flaw, to its Known Exploited Vulnerabilities catalog on evidence of active exploitation. The Node.js project had published its advisory for the bundled decoder six days earlier, on 21 October 2026. For CISA KEV patching the listing raises the urgency, but it does not touch the hard part of this Brotli vulnerability: finding every copy of the decoder in your estate.

What the flaw is, and what KEV adds

The bug is in the Brotli decoder bundled with Node.js. An invalid block switch was reported as a need for more input instead of a format error, so the decoder kept appending to an eight-byte internal buffer and wrote past it. Exploitation needs attacker-supplied Brotli data that an application decompresses with node:zlib.

The listing is the only new fact. As of 26 October, Tenable listed the CVE as not in KEV, and Rapid7 knew of no in-the-wild exploitation. CISA’s own record carried SSVC exploitation “none”, automatable “no” and technical impact “total”. We found no source that says who is exploiting it or how. Public proof-of-concept code exists, and Imperva reported lab code execution on Node.js 24.22.0 (arm64) that needed several attempts; a lab result is not evidence of attacks in the wild.

Vendor pages lag as well. Palo Alto Networks’ advisory, updated 27 October, still says it is not aware of any malicious exploitation, which conflicts with the listing. Fortinet’s FG-IR-26-187 shows “Known Exploited: No” in its header table next to a different CVE, the TLS hostname bug. Read status fields as timestamps, not verdicts.

Fixed versions to check first

The Node.js security update ships fixes in 22.23.4, 24.22.1 and 26.12.1. Node.js 20.x and earlier are end of life and get no fix, so for those the answer is an upgrade or a compensating control. Upstream Brotli shipped the same fix in 1.2.1, 1.1.1 and 1.0.10; the affected ranges are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1 and 1.2.0 before 1.2.1.

Outside Node.js, the vendors named by Rapid7 and Wiz are these:

  • Bun: 1.0.21–1.4.3 affected, fixed in 1.4.4.
  • .NET: fixed in 8.0.33, 9.0.22 and 10.0.14.
  • Python: Brotli 1.2.1 and brotlicffi 1.2.1.0.
  • Also named by Rapid7: Envoy and Istio, brotli4j, and OS packages.

Why your package manager reports nothing

The vulnerable code is compiled into the Node.js runtime under deps/brotli. The npm package named “brotli” is unrelated, so an npm ls that comes back clean tells you nothing about this bug.

A package manager reports what was installed. It cannot report what was compiled in.

The bundled version also varies by release line. HeroDevs reads Brotli 1.1.0 in Node.js 20.x and 18.x and 1.0.9 in 16.x through 12.x; that is one vendor’s code reading, so verify it against your own binaries. Distributions differ too: Debian’s nodejs uses the system Brotli library, while Ubuntu says its nodejs uses vendored Brotli. The same package name can mean two different patch paths.

Build an embedded library inventory from the outside in

An embedded library inventory has to be built per layer, because each layer hides the copy differently.

  • Runtimes: list every host and container image that ships Node.js, Bun, .NET, Python with Brotli or brotlicffi, or a JVM app using brotli4j. For a Node.js binary from nodejs.org or copied into an image, compare its version with the fixed releases. On Debian-style packages that link the system library, the Node.js version is not enough: check the distribution’s Brotli package and its security notice instead. We have no single command to read the bundled Brotli version across runtimes, so confirm it per runtime.
  • Images and build caches: a runtime copied into an image never appears in the OS package list. Search every image layer and build cache for Node.js binaries by version string, then map each release line to the deps/brotli lineage it carries (1.1.0 for 20.x and 18.x, 1.0.9 for 16.x through 12.x, per HeroDevs). Treat any line with no fixed release as unpatchable in place.
  • Proxies and meshes: Envoy and Istio are on Rapid7’s list. Check the version in each sidecar and gateway image, not just the control plane.
  • Appliances: Palo Alto Networks lists PAN-OS 12.2, 12.1 and 11.2 below the listed hotfixes, plus Prisma Cloud Application Security Transporter Client below 0.2.9. PAN-OS 11.1 and 10.2 are not affected, and Panorama is not impacted. On a firewall, show system setting brotli shows the state and set system setting brotli-encoding disable turns the decoding off. Threat ID 97686 (content version 9165+) gives partial coverage only.
  • Vendor lists still in flux: Fortinet says it is “currently investigating” FortiOS, FortiProxy, FortiMail and FortiSandbox, and lists FortiManager, FortiAnalyzer and FortiWeb as not impacted. We could not verify Cisco’s advisory or product list, so read it at Cisco directly; its status is unknown to us. Re-check every vendor page before you close a ticket.

In our SecOps practice we run vulnerability scanning and external attack surface mapping, and the second answers what the first cannot: which of these copies a stranger can actually reach from the internet. The inventory tells you where the decoder is; the mapping tells you which of those places matter first.

Prioritise the copies that decompress untrusted input

Akamai’s analysis is the useful filter. Exposed paths include responses from the built-in fetch() and request bodies parsed by Express 5, while a bare Node.js HTTP server does not decode incoming Brotli bodies on its own. On PAN-OS, exposure applies to PA-Series and VM-Series firewalls with Brotli inspection and TLS decryption enabled on the dataplane; the management interface is not affected.

Rank what you find in this order:

  1. Internet-facing services that parse Brotli-encoded request bodies, such as Express 5 apps.
  2. Inline devices that decrypt and inspect traffic with Brotli decoding on.
  3. Services that call fetch() against servers you do not control, since the response is attacker-supplied data.
  4. Internal tools and batch jobs that only decompress data you produced yourself.

CISA’s BOD 26-04, issued on 10 June 2026, is a reasonable model for this ranking even though it binds only US federal civilian agencies. It scores each asset and vulnerability pair on exposure, KEV status, automation and technical impact, and KEV listing alone no longer sets the deadline. Its full timelines take effect on 7 December 2026.

Where you cannot patch, as on Node.js 20.x, stop accepting Brotli-encoded request bodies where the application has no need for them. That closes only the request path: fetch() responses from servers you do not control stay exposed until the runtime is patched. Put the end-of-life runtime on the migration list, because the next bundled-library bug will find it in the same place.

Sources