CVE-2026-111497

Out-of-Bounds Write in Google Brotli Decoder

Exploitation likely. EPSS gives it a 33% chance of exploitation in the next 30 days. Fixed versions are out.

CVSS —Not scored EPSS percentile98th33% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1 product3 fixed builds listed below

Published 2026-10-22Updated 2026-10-26Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Google BrotliAffected: ≥ 1.0.3, < 1.0.10Upgrade to: 1.0.10Affected: ≥ 1.1.0, < 1.1.1Upgrade to: 1.1.1Affected: ≥ 1.2.0, < 1.2.1Upgrade to: 1.2.1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Ask your developer or IT provider whether any software you use (including Node.js) bundles Brotli version 1.0.3 through 1.2.0.
If you run Node.js directly, update to the latest security release that includes the fixed Brotli version.
For custom applications, update the Brotli library to 1.0.10, 1.1.1, or 1.2.1, whichever matches your current branch.
Confirm with your vendor if you use third-party software that may embed Brotli, and ask them to confirm they've updated.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

In plain language

Written by AI from the record

A flaw in the Brotli compression library (used inside many apps, like Node.js) could let a malicious file crash or corrupt a program, but there's no sign anyone is exploiting it, so fix it on your normal update schedule rather than panicking.

Out-of-bounds write in Google Brotli's decoder (decode.c) triggered by a crafted Brotli-compressed stream, affecting versions 1.0.3–1.2.0 and allowing memory corruption, information disclosure, denial of service, or potentially remote code execution.

If you're affected

Application crashes
Possible data exposure
Potential remote code execution
Service disruption

What is it

Brotli is a compression tool built into many web servers, browsers, and programs like Node.js to shrink files for faster transfer. This flaw means a specially crafted compressed file could trick the decompression process into writing data where it shouldn't, similar to a corrupted zip file causing the unzipping program to misbehave. In the worst case this could let an attacker run unwanted code, but that requires a very specific malicious file reaching your system.

Who is affected

This matters to you if you run Node.js or any software that bundles the Brotli compression library in a version between 1.0.3 and 1.2.0. Since Brotli is often embedded inside other tools rather than installed directly, check with whoever manages your software stack to confirm whether it's in use.

How urgent is it

There is no evidence of active exploitation, no public exploit code, and this flaw is not listed by CISA as a known-exploited vulnerability. You can treat this as a routine update to apply during your normal patch cycle rather than an emergency.

What to do — in detail

Inventory all systems and applications using Brotli, especially Node.js deployments, to identify versions in the vulnerable range 1.0.3–1.2.0.
For Node.js, apply the October 2026 security release referenced in the vendor advisory, which bundles the patched Brotli decoder.
For direct Brotli library usage, upgrade to the fixed version matching your branch: 1.0.10, 1.1.1, or 1.2.1.
No official workaround exists beyond upgrading; if patching must be delayed, consider restricting processing of untrusted compressed streams where feasible.
No CISA KEV listing and no due date apply. Monitor for any future exploit code releases or KEV addition, which would elevate urgency.

Technical context

Weakness type: CWE-252 (unchecked return value) combined with CWE-787 (out-of-bounds write), located in the Brotli decoder's decode.c. Attack vector is a crafted Brotli-compressed stream processed by a vulnerable decoder, requiring no authentication but requiring the attacker to deliver the malicious stream to a parsing application. Exploitation status: no known exploit code, not in CISA KEV, and press attention is limited to patch-release coverage rather than active-attack reporting. Exploit maturity is currently theoretical/PoC-absent, consistent with a routine remediation timeline.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS98th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

33% chance of exploitation activity in the next 30 days, which ranks it in the 98th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

18 events over 4 days, from the signal feeds we watch.

2026-10-26Nuclei check addedpatch available, record updated
2026-10-25EPSS band changelow → moderateepss band change
2026-10-24Patch availablepatch available, record updated, record updated
2026-10-23Patch availablepatch available, record updated, record updated
2026-10-22Patch availablepublished, weakness classified, att&ck mapped, record updated