The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Brotli compression flaw to its Known Exploited Vulnerabilities catalogue, ordering US federal civilian agencies to patch by 10 November 2026. The flaw, tracked as CVE-2026-111497, affects the widely used Brotli data-compression library and the software built on it, including Node.js.

The vulnerability is an out-of-bounds write in the Brotli decoder, scored 9.2 out of 10 for severity. A crafted Brotli-compressed stream can corrupt decoder memory, disclose memory, cause a denial of service, or potentially allow remote code execution, without authentication and without user interaction. It affects Google Brotli versions 1.0.3 through 1.2.0, and is fixed in versions 1.0.10, 1.1.1 and 1.2.1.

Node.js and web servers in scope

Node.js fixed the flaw in versions 22.23.4, 24.22.1 and 26.12.1 as part of its October security release. Applications are exposed where they decompress attacker-controlled Brotli data, such as request bodies or fetched responses. Security researchers published a proof of concept on 22 October showing code execution on unpatched Node.js 24.22.0, while the patched 24.22.1 rejected the same input.

What to do

Administrators should update Brotli and Node.js to the fixed versions, audit web applications that handle compressed data, and monitor for anomalous process behaviour. CISA lists ransomware use of the flaw as unknown, and reporting distinguishes exploitation attempts from confirmed compromises, so organisations should patch promptly rather than wait for victim reports.