CVE-2026-111497: Brotli exploitation raises urgency for Node.js and decoder updates

CoeLab Real-World Impact: 78/100 — High. Editorial score v1.0. Evidence checked 2026-10-28T09:10:10.641523+00:00. CVSS and EPSS are separate measures, not this editorial score.

Rating breakdown: exploitation: 30, reachability: 25, consequences: 23, operational relevance: 0.

Who is affected

CVE-2026-111497 is a memory-corruption vulnerability in Google's Brotli decoder. The practical question is not simply whether Brotli appears in a dependency list: it is whether an affected decoder processes compressed bytes an attacker can influence. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 27, 2026. That is the new prioritization signal, not the discovery of a new vulnerability today.

Google's CVE record lists three affected version ranges: 1.0.3 up to but not including 1.0.10; 1.1.0 up to but not including 1.1.1; and 1.2.0 up to but not including 1.2.1. Its update guidance identifies 1.0.10, 1.1.1 and 1.2.1 as fixed releases for those branches. Use those structured ranges rather than interpreting the description's broad shorthand as meaning every intervening release is vulnerable.

Node.js confirms that its bundled decoder exposes this issue in the 22.x, 24.x and 26.x release lines. Its October security bulletin lists updated releases 22.23.4, 24.22.1 and 26.12.1. Updating a separately installed Brotli command-line utility is not evidence that a runtime's bundled decoder has changed. Check the software component actually used by the application.

Real-world impact and exploitation evidence

The Node.js advisory describes malformed compressed data causing writes beyond a decoder buffer. Depending on the application and exploitation conditions, consequences can include a process crash, disclosure of process memory or remote code execution. These are possible outcomes, not a claim that every exposed application can reliably be taken over. Memory corruption inside a service also makes the service's permissions and isolation relevant to the resulting damage.

CISA's KEV listing establishes that this is a vulnerability known to have been exploited. It does not provide a first-attack date, victim count, campaign scope or an application-specific exploitation success rate. Its ransomware-use field is Unknown, which must not be converted into either a ransomware attribution or a statement that ransomware use has been ruled out. October 27 is the catalog addition date, not necessarily the first exploitation date.

The supplied CoeLab Real-World Impact score is 78/100, High. Exploitation contributes 30 points because of KEV inclusion; reachability contributes 25 for the network, no-privilege, low-complexity vector; consequences contribute 23 from the published 9.2 CVSS base score; operational relevance contributes zero because the category heuristic did not establish it. That zero is a coverage limitation, not evidence that a widely embedded decoder is operationally harmless. The score is editorial prioritization, not CVSS, EPSS, measured deployment prevalence or a finding about any particular reader's exposure.

Attack prerequisites

An attacker must get malicious Brotli-compressed input processed by an affected decoder. Node.js specifically identifies applications using node:zlib to decompress attacker-supplied Brotli data. A network-facing Node.js process is therefore not automatically a confirmed vulnerable endpoint merely because it runs Node.js: the relevant decompression path must be reachable. Trace incoming compressed content and any other untrusted compressed inputs through the actual application.

Google's published vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, with a 9.2 base score. It expresses network access, low complexity, no required privileges and no user interaction, but also marks attack requirements as present. Do not drop that qualification when translating severity into urgency. The reviewed sources do not establish one universal application configuration or a guaranteed code-execution outcome across products.

Actions and fixes

Prioritize affected services that actually decompress externally controlled Brotli data. For directly managed Google Brotli dependencies, move to the vendor's fixed release for the maintained branch: 1.0.10, 1.1.1 or 1.2.1. Google's 1.2.1 release explicitly identifies this CVE as its security fix. For affected supported Node.js lines, deploy the bulletin's corresponding security release or a later supported release containing the fix: 22.23.4, 24.22.1 or 26.12.1.

Treat dependency replacement and deployment as separate steps. Rebuild and redeploy applications or images carrying the old component, restart affected processes as appropriate, and verify the running runtime rather than only the build manifest. For packaged products, follow that product vendor's update guidance; an upstream version comparison alone may not reflect a distribution's backported fix. These are remediation checks, not evidence that any specific deployment has been tested here.

Where an immediate upgrade is not possible, preventing untrusted Brotli input from reaching the affected decoder is a practical exposure-reduction option only if it can be enforced completely. Disabling an applicable decompression feature or rejecting that input may require application changes and compatibility checks. The reviewed vendor material does not document a universal configuration workaround. Ordinary authentication or rate limiting should not be presented as an equivalent fix for the memory-corruption defect.

Uncertainty and what could change

The vendor CVE record contains an earlier datePublic value of February 27, 2026, while the CVE publication timestamp is October 22. Google's 1.2.1 release was published October 21. The record's CNA update is dated October 27 and the overall CVE record update October 28. Those dates describe different events; the earlier datePublic field is not sufficient evidence of the discovery date, which remains unverified here. A precise last-update timestamp for the Node.js advisory was not established.

Additional vendor guidance could clarify affected downstream products, workaround reliability or exploitation conditions. More detailed public incident evidence could also change deployment priorities. Until then, the defensible conclusion is focused urgency: a known-exploited decoder flaw with available fixes warrants prompt attention wherever untrusted data reaches vulnerable code, without assuming that every Brotli installation is remotely exploitable.

Sources and evidence date

The Coe Lab checked Google's release information and CNA-authored CVE record, the Node.js October security bulletin and CISA's matching KEV entry on October 28, 2026. The CVE record was accessed through the official CVE List repository; its canonical CVE page is included below. The public Security index was also checked for duplicate coverage. No exploit was run, no affected deployment was tested, and no private infrastructure information was used.

Primary-source links

https://github.com/google/brotli/releases/tag/v1.2.1

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111497.json

https://www.cve.org/CVERecord?id=CVE-2026-111497

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497

AI-assisted research and drafting, with a separate model editorial review. CoeLab ratings are editorial judgments, not a substitute for checking your own versions and vendor advisories. Methodology: https://thecoelab.com/blog/security/methodology