The Brotli Vulnerability Is Not Just a Node.js Problem: Where to Check and What Is Known About Exploitation

A vulnerability in the compression library Brotli (CVE-2026-111497) was added to the US CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026. The deadline for US federal agencies is November 10 (I checked the data in CISA’s KEV directly).

Node.js disclosed it on October 21, so it is widely known as a Node.js problem. But the cause is the Brotli library that Node.js bundles, so other products that use the same library are affected too.

This article is for people who want to know where to check in their own environment. It is built on primary sources and separates what is confirmed from what is not. The information is current as of October 29, 2026. Sources are given next to each statement.

Key points

• Brotli is a compression format used in web traffic. Its decoder has an out-of-bounds write flaw. If the decoder is made to expand crafted data, the possible results are a crash, a leak of memory contents and, in some cases, code execution (GitHub advisory).
• The fixed versions are Brotli 1.2.1, 1.1.1 and 1.0.10 (Google).
• It is not limited to Node.js. Fixes have been released for Node.js, Bun, Python packages, .NET and Palo Alto’s PAN-OS, among others.
• Whether you are exposed depends on whether you decompress Brotli data that an attacker supplied. That can be decided in places that are easy to miss.
• On exploitation, ELLIO reported attack traffic and CISA added the flaw to KEV. But reliable code execution has been shown only in limited setups.
• What to do: list what you run, update, restart, and rebuild container images.

What happened

It was found by OpenAI Codex Security (Khai Tran and Sylvie Mayer; Node.js).

The fix went into the source in February, and the release came in October. Help Net Security points out that for about eight months in between, the fix could be read in the public repository (Help Net Security).

What is affected

Brotli is bundled inside other products. The status by product is below.

JPCERT/CC names Node.js, Bun and the Python Brotli packages as examples, and says Brotli is embedded in a wide range of products. Google offers no mitigation (JPCERT/CC, in Japanese).

Envoy, Istio, curl, FFmpeg, Apache Arrow, ClickHouse and Java’s brotli4j also come up in discussion of the impact (Help Net Security, Aikido). These come from news coverage and security-vendor blogs, so check each product’s official notice.

Points to watch:

• Node.js bundles its own Brotli. Updating the OS library does not fix it.
• Debian’s Node.js uses the OS Brotli. The Node.js version number alone does not tell you whether it is patched (Sysdig).
• Container images stay old until you rebuild them (Aikido).
• Self-contained .NET apps are not fixed by updating the host. They must be rebuilt and republished (Microsoft .NET Blog).

When are you exposed

Having Brotli installed is not enough to be attacked. The problem arises when you decompress Brotli data the attacker prepared.

On PAN-OS 11.2.4 and later, Brotli inspection is off by default. To check, run show system setting brotli in the CLI. If it shows “Enabled: yes,” you are exposed (Palo Alto).

How firm is the evidence of exploitation

In short: attack traffic has been observed and CISA lists it as exploited, but it has not been shown that code can be run reliably in any environment. Crashes are reported to be easy to reproduce (Sysdig). A service going down is damage in itself.

What to do now

1. List what you run

Work through these in order.

1. Services that accept outside data and decompress it (Node.js, Python, .NET, Java and so on)
2. Services that call user-supplied URLs or webhook targets from the server side
3. Appliances such as firewalls and load balancers (those with TLS decryption and Brotli inspection)
4. Container images, CI runners, serverless functions and build servers

2. Update

The commands to check:

# Node.js
node --version
node -p "process.versions.brotli"

# Python
pip show Brotli brotlicffi
pipdeptree -r -p Brotli

# .NET
dotnet --list-runtimes

• For Node.js, move to 22.23.4, 24.22.1 or 26.12.1 or later. 20, 23 and 25 have no fix, so move to 22, 24 or 26.
• Python may pull Brotli in indirectly through urllib3, requests, aiohttp, httpx or Scrapy. Check your lockfiles too (Aikido).
• For .NET, move to 8.0.33, 9.0.22 or 10.0.14 or later, then restart the app (Microsoft .NET Blog).
• For PAN-OS, move to a fixed version in the table above. A hotfix that only fixes PHP2Shell is not enough. For example, 11.2.10-h16 fixes only PHP, and 11.2.10-h17 fixes both PHP and Brotli (Palo Alto). If you cannot update, disable Brotli encoding (in the CLI, set system setting brotli-encoding disable).
• After updating, restart processes and rebuild and redeploy container images. Otherwise the old decoder keeps running.

3. Stopgaps if you can’t update right away

None of these makes you safe. They buy time.

• Reject requests with Content-Encoding: br at a proxy or load balancer. This does not cover responses your server fetches (Aikido).
• On Express 5, reject compressed bodies with express.json({ inflate: false }). This also rejects gzip, so check the impact on clients first (Sysdig).
• On Python, if you don’t use them, uninstall Brotli and brotlicffi.

The Node.js advisory gives no workaround. To protect against responses that Node.js fetches, updating is the only way.

4. Check for intrusion

Attack traffic has been observed. Before you update, check the following.

• Whether a Node.js process crashed and then started a shell or another program (Sysdig lists a crash followed by in-place program execution as the typical pattern)
• Whether there is outbound traffic you don’t recognize
• Whether cloud credentials are left in environment variables

What not to do

• Don’t look only at Node.js. Python, .NET and appliances carry the same component
• Don’t feel safe just because you updated an OS library. Node.js bundles its own Brotli
• Don’t update without restarting
• Don’t try PoCs you found online in production

What is not confirmed

• I could not check ELLIO’s original. The details of what it observed (counts, targets, period) are unknown
• Who has actually been hit is unknown. CISA names neither the attacker nor the targets
• Imperva’s exploit is unpublished. How far code execution in a standard setup can be reproduced is unknown
• Whether a product not on the list embeds Brotli has to be checked in that product’s official notice
• There are reports that the same PAN-OS devices were compromised in the PHP2Shell attacks. That is a separate vulnerability (PHP). The story is in the summary of PHP2Shell for engineers. The full set of ten Node.js fixes is in the Node.js summary

Related articles

• Two Critical GitLab Flaws, Not One: Why the October 12 Fix Is Not Enough: The same pattern, a flaw in a component that a product bundles: GitLab and its bundled Ruby
• VPNs, Email Gateways and Remote-Support Tools: The Edge Devices Exploited This Month, and What to Check Now: The edge devices confirmed exploited this month
• Node.js Fixes 10 Vulnerabilities (CVE-2026-111497 and More): A Technical Summary for Engineers on the October 21, 2026 Security Release: The engineers’ summary of all ten Node.js fixes
• An Adobe Commerce and Magento Flaw Joins CISA’s Exploited List: Fixed in July, Attacked Since March, and What to Check: The other flaw added to KEV the same day, October 27: a file-upload flaw in Adobe Commerce and Magento. Fixed in July, with attacks reported from March

If you’d like help finding which components in your environment include Brotli, updating them, or checking for intrusion, get in touch below.