Singapore's Cyber Security Agency (CSA) has issued a fresh alert on the critical Brotli decompression flaw CVE-2026-111497, warning that the bug now has a public proof-of-concept exploit and is reportedly being actively exploited in the wild. The alert, numbered AL-2026-154 and published on 30 October 2026, lists a CVSS base score of 9.8 out of 10 and urges organisations to patch immediately.

The wording matters. CSA says the flaw is reportedly being actively exploited, relaying reported exploitation activity rather than asserting it has independently verified compromises, and the alert does not cite a specific confirmed breach or name a threat actor. That makes this a credible reported risk, not a fully documented, attributed campaign, and this report follows CSA's own language rather than overstating it.

What to patch

The flaw is an out-of-bounds write in the Brotli decoder bundled with Node.js and Microsoft .NET. Node.js fixed it in versions 22.23.4, 24.22.1 and 26.12.1, released on 27 October, while Microsoft shipped out-of-band .NET updates on 25 October in versions 8.0.33, 9.0.22, 10.0.14 and 11.0.0-rc.3. .NET versions 8, 9, 10 and 11 are all affected, not just Node.js.

DailyByte covered the original fix last week; this alert is the exploitation-status update that changes the urgency. Administrators should inventory Node.js and .NET deployments, including bundled runtimes inside other tools, apply the fixed versions, and check for signs of prior compromise, since patching alone does not remove an attacker who is already inside.