Brotli and CVE-2026-111497: what to check beyond Node.js
Identify the vulnerable Brotli copy, check product-specific fixes and verify that the deployed process actually uses the update.
Related links
CVE-2026-111497 affects Brotli’s native decoder and can corrupt memory while processing a malformed compressed stream. The Node.js advisory describes possible crashes, memory disclosure and code execution.
Start with two questions: which decoder copy does the application use, and can third parties control the data it decodes?
What has been demonstrated
Imperva documents code execution against the official Node.js 24.22.0 Linux arm64 image, through responses consumed by fetch() and request bodies processed by middleware. Their setup required multiple attempts; Node.js 24.22.1 rejected the same inputs. This demonstrates impact in that environment, rather than active exploitation of every deployment.
On Node.js servers, inspect request parsers: body-parser supports automatic Brotli inflation. A basic HTTP server does not start decoding Brotli simply because a request carries Content-Encoding: br.
Confirmed fixes by component
| Component | Version fixing this CVE |
|---|---|
| Google Brotli | 1.0.10, 1.1.1 or 1.2.1, depending on the branch |
| Node.js | 22.23.4, 24.22.1 or 26.12.1, depending on the supported branch |
Python Brotli package | 1.2.1 |
Python brotlicffi package | 1.2.1.0 |
| .NET 8 / 9 / 10 | 8.0.33 / 9.0.22 / 10.0.14 |
| Brotli4j | 1.24.0, including the native-* artifacts |
These releases include the fix; there is no reason to downgrade a newer fixed release to them. Distribution packages may contain backported patches: check the vendor advisory.
For Python, the affected components are specific packages, not every Python installation. Microsoft also ties exposure to decoding untrusted data; its advisory covers HttpClient, ASP.NET Core and NativeAOT. Product configuration matters.
Find the copy still running
An initial inventory can record the actual runtime and environment packages:
node -p 'JSON.stringify({node: process.version, brotli: process.versions.brotli})'
python -m pip show Brotli brotlicffi
dotnet --list-runtimes
Run only the relevant command inside the service’s container or environment. This is inventory, not proof that the vulnerability is absent: backports may retain the library version number. The Node.js 24.22.1 release incorporates the fix through a cherry-pick.
Brotli4j ships its own native library. Updating the system’s libbrotli does not replace it. Microsoft requires self-contained and NativeAOT applications to be rebuilt and redeployed with fixed components.
To finish the rollout, check the deployed artifact and restart processes retaining the older runtime. Rebuild containers when they contain the vulnerable copy. Then verify normal request and response handling in a controlled environment.
Prioritize the intervention
Prioritize paths that decode third-party input using a vulnerable component. For temporary mitigation, restrict those paths following product-specific guidance and test compatibility. Removing br from HTTP negotiation does not establish that every explicit decompression path has disappeared.
Crashes during decompression can guide an investigation, but do not establish an intrusion on their own. Correlate the runtime version, input path and logs. For the wider runtime patching context, see October’s ten Node.js CVEs.