NewsCompaniesFlawsGuides
Get the app
HighPartly fixedBeing used in attacksUpdated

Brotli flaw CVE-2026-111497 exploited as Node.js, .NET and vendor fixes roll out

Attackers are targeting a Brotli flaw in business software and potentially WordPress hosting. Ask IT or your website host to patch every affected library and bundled copy, then restart or redeploy services. Some vendor fixes remain pending.

What to do

Ask IT to apply vendor fixes, including Node.js 22.23.4, 24.22.1 or 26.12.1 and .NET 8.0.33, 9.0.22, 10.0.14 or 11 RC3, update bundled copies, rebuild affected applications and containers, and restart services. If you run a WordPress website, ask its host to confirm that every Brotli copy used by the site is patched and affected services have been restarted or redeployed. Where updates remain pending, ask the supplier for its recommended temporary protection.

What’s happening

A flaw in Google's Brotli decompression library can corrupt memory when applications unpack attacker-controlled data, potentially exposing information, crashing services or allowing code execution. Affected software includes Node.js, .NET, Python packages and PHP's Windows packages. Canada's Cyber Centre confirms CISA listed it as exploited on 27 October; Palo Alto Networks and Cisco previously reported no known malicious use affecting their products. Wordfence has now demonstrated code execution in a specific WordPress lab environment, stopped by patching the server's Brotli library. It found no publicly documented successful WordPress compromise through 2 November; the result does not establish that every WordPress site is vulnerable. Updating WordPress alone does not repair the server library. Fixes exist for Brotli, supported Node.js lines, .NET and rebuilt PHP Windows packages. Remediation remains partial: AWS still lists updates in progress, Cisco lists future fixes, and Fortinet continues investigating. Applications carrying their own vulnerable copies need rebuilding or vendor updates.

What
Flaw
Affects
Google Brotli decompression library and software that includes it, including Node.js, Microsoft .NET and some WordPress hosting environments
Affected
Google Brotli 1.0.3–1.0.9, 1.1.0 and 1.2.0, including copies bundled in other software
Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1; end-of-life lines do not receive these security releases
Microsoft .NET 8.0.0–8.0.32, 9.0.0–9.0.21 and 10.0.0–10.0.13; .NET 11 previews before 11.0.0-rc.3.26522.148
Official PHP Windows packages for PHP 8.2–8.5 containing vulnerable Brotli, including the original 8.2.35, 8.3.36, 8.4.27 and 8.5.12 packages before their -1 rebuilds
Envoy v1.39.2, v1.38.5, v1.37.7 and v1.36.11 when the Brotli decompressor is configured
Palo Alto Networks Prisma Cloud Application Security Transporter Client before 0.2.9
PAN-OS affected releases on the 11.2, 12.1 and 12.2 lines listed in the vendor advisory, when Brotli traffic inspection and TLS/SSL decryption are enabled
AWS Lambda Node.js and .NET runtimes identified in bulletin 2026-155-AWS, plus other affected AWS runtimes and images listed there
Fixed in
Google Brotli 1.0.10, 1.1.1 and 1.2.1
Node.js 22.23.4, 24.22.1 and 26.12.1
Microsoft .NET 8.0.33, 9.0.22, 10.0.14 and 11.0.0-rc.3.26522.148
Official PHP Windows package rebuilds 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1
Envoy v1.36.12, v1.37.8, v1.38.6, v1.39.3 and v1.40.0
Python Brotli 1.2.1 and brotlicffi 1.2.1.0
PowerShell 7.4.22, 7.5.13 and 7.6.9
Palo Alto Networks Prisma Cloud Application Security Transporter Client 0.2.9
PAN-OS branch-specific fixes: 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, 11.2.16-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3 and 12.2.4-h1
CVE
CVE-2026-111497
Since
21 Oct 2026

Timeline

  1. Update

    Wordfence confirmed code execution in a specific WordPress test environment using vulnerable server-level Brotli; patching Brotli stopped it. Its review through 2 November found continuing attack attempts but no publicly documented successful WordPress compromise.

  2. Vendor revised

    Palo Alto Networks added Prisma Cloud and Strata Cloud Manager to its remediated services list. Its advisory also lists released PAN-OS fixes and requires no customer action for the listed remediated cloud services.

  3. Vendor revised

    Cisco updated its advisory covering the Brotli flaw and other Node.js vulnerabilities. Several product fixes remained scheduled for November or later, and investigations continued.

  4. Vendor revisedPartly fixed

    AWS detailed fixes and staged rollouts across affected runtimes and services. Its bulletin still described updates for CloudWatch Synthetics Python Selenium canaries and CodeBuild images as in progress; target dates do not confirm completion.

  5. CISA added

    CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue, according to Canada's Cyber Centre. The centre urged organisations to find and update affected components, including bundled copies.

  6. New fix

    PHP released rebuilt Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 containing Brotli 1.2.1. The PHP runtime version stays unchanged, so the package's -1 suffix identifies the corrected build.

  7. New fix

    Microsoft released emergency updates: .NET 8.0.33, 9.0.22, 10.0.14 and .NET 11 Release Candidate 3. Applications carrying their own runtime must be rebuilt and republished.

  8. New fix

    Google released Brotli 1.0.10, 1.1.1 and 1.2.1 with the security fix. Products that bundle Brotli need to incorporate the corrected library.

  9. Made publicPartly fixed

    Node.js disclosed CVE-2026-111497 in its bundled Brotli decoder and released fixes in 22.23.4, 24.22.1 and 26.12.1. Applications that decompress attacker-controlled Brotli data could crash, expose memory or run attacker-supplied code.

Sources

  1. Brotli security releases 1.0.10, 1.1.1 and 1.2.1Google · 21 Oct 2026
  2. Wednesday, October 21, 2026 Security ReleasesNode.js · 21 Oct 2026
  3. Microsoft Security Advisory CVE-2026-111497 — .NET Brotli Decoder Out-of-bounds Write VulnerabilityMicrosoft · 25 Oct 2026
  4. .NET October 2026 Out-of-Band Security UpdatesMicrosoft · 25 Oct 2026
  5. Updated PHP Windows builds for Brotli security fixPHP · 26 Oct 2026
  6. AL26-027 — Critical vulnerability impacting Google Brotli — CVE-2026-111497Canadian Centre for Cyber Security · 28 Oct 2026
  7. CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory DisclosureAWS · 28 Oct 2026
  8. Vulnerabilities in Node.js Affecting Cisco Products: October 2026Cisco · 30 Oct 2026
  9. Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks ProductsPalo Alto Networks · 31 Oct 2026
  10. Node2Shell CVEs — FG-IR-26-187Fortinet · 29 Oct 2026
  11. Patch now: PHP2Shell, Brotli, and eMudhra guidance for customersMicrosoft · 30 Oct 2026
  12. Out-of-Bounds Write in Brotli DecompressorEnvoy · 23 Oct 2026
  13. Brotli: Out-of-bounds write in the Brotli decoder also affects the PyPI Brotli packageGitHub Advisory Database · 29 Oct 2026
  14. Brotli 1.2.1 releaseBrotli maintainers · 22 Oct 2026
  15. BrotliCFFI 1.2.1.0 release and changelogBrotliCFFI maintainers · 22 Oct 2026
  16. HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress SitesWordfence · 2 Nov 2026
  17. Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write VulnerabilityGitHub Advisory Database · 3 Nov 2026
  18. CVE-2026-111497 — vulnerable and fixed Debian packagesDebian
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS