CVE-2026-111497 is a memory-corruption flaw in Google's Brotli decompression code. A carefully malformed compressed stream can trigger an out-of-bounds write while a vulnerable program decodes it. Depending on the affected process and deployment, the result can be a crash, disclosure of process memory, or potentially arbitrary code execution.
The CVE is especially relevant to HTTP because Brotli is commonly negotiated as the br content encoding. A vulnerable client may decode a hostile server's response; a server or proxy may decode a crafted request body. Applications that explicitly decompress uploaded files or other untrusted data can also reach the same bug. The software must process attacker-controlled Brotli data for the flaw to be reachable.
How the decoder fails
The bug is in the Brotli decoder's handling of an invalid block switch. In the affected code, an error could be treated as a request for more input instead of a permanent format error. The streaming decoder then continued appending bytes to a small internal buffer, eventually writing beyond its bounds. Node.js describes this as an out-of-bounds write that can corrupt process memory; the Envoy and upstream Brotli advisories describe the possible outcomes as memory disclosure, denial of service, and potentially remote code execution.
The upstream CVSS 4.0 score is 9.2 Critical. Product advisories may use different severity labels and scores: Node.js describes its issue as High, and Microsoft's .NET advisory assigns 8.1 High. Those scores do not change the practical requirement to check whether a vulnerable decoder is actually processing untrusted input.
Popular software to check
| Software | Affected releases and fixed versions | Exposure notes |
|---|---|---|
| Google Brotli library | Affected decoder releases span 1.0.3–1.2.0; upstream fixes are 1.0.10, 1.1.1, and 1.2.1. | Check downstream packages and vendored copies; some products ship their own decoder instead of using the system library. |
| Node.js | The 22.x, 24.x, and 26.x lines are affected. Install 22.23.4, 24.22.1, or 26.12.1, respectively. | Applications using node:zlib to decode attacker-controlled Brotli data are at risk. Check web clients, servers, workers, and bundled Node runtimes. |
| Bun | The Bun project lists 1.0.21 through 1.4.3 as affected. Upgrade to 1.4.4. | Bun's fetch automatically advertises and decodes Brotli responses; the node:zlib and DecompressionStream Brotli APIs also reach the decoder. Rebuild executables produced with bun build --compile. |
| Envoy Proxy | Affected: 1.39.2, 1.38.5, 1.37.7, 1.36.11. Fixed: 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12. | Envoy is exposed when its Brotli decompressor is configured. |
| Istio | Affected releases: 1.31.0–1.31.1, 1.30.0–1.30.5, and 1.29.0–1.29.8. Upgrade to 1.31.2, 1.30.6, or 1.29.9, as applicable. | Istio's advisory says the Envoy issue affects deployments that enable Brotli decompression, for example through an EnvoyFilter. |
| .NET and ASP.NET Core | Fixed runtime versions: 8.0.33, 9.0.22, and 10.0.14; .NET 11 previews: 11.0.0-rc.3.26522.148. | Request and response decompression are not enabled by default. Exposure requires enabling Brotli decompression or explicitly using APIs such as BrotliStream or BrotliDecoder. .NET Framework is not affected. Rebuild self-contained and NativeAOT applications with fixed packages. |
These are examples, not a complete inventory. The defect is in the shared Brotli decoder, so libraries, native packages, language bindings, and products that vendor their own Brotli copy may have separate release schedules. Check the advisory for the runtime or product you deploy, including vendor backports where package versions do not change to match upstream numbering.
What administrators and developers should do
- Update the runtime or product. Apply the fixed release for Node.js, Bun, Envoy, Istio, or .NET. For standalone or statically linked applications, rebuild and redeploy so the executable includes the fixed decoder.
- Find every Brotli decode path. Review HTTP clients that accept
Content-Encoding: br, request-decompression middleware, proxy filters, explicit Brotli APIs, and services that inspect compressed uploads. A dependency inventory alone may miss a runtime or library bundled into a container or executable. - Use a temporary restriction if an update is delayed. Avoid decompressing untrusted Brotli streams. Where the application supports it, disable Brotli decoding while preserving other supported content encodings. Treat this as a short-term reduction in exposure, not a replacement for patching.
- Restart or rebuild deployed workloads. Updating packages on disk does not replace already-running workers or a decoder linked into a self-contained binary. Verify the active runtime and image versions after rollout.
- Review the exposure window. Check for unexplained process crashes and unexpected behavior in services that accepted untrusted Brotli data. A crash may be visible, but the absence of an alert does not establish that a memory-corruption attempt did not occur.
Takeaway
CVE-2026-111497 turns malformed Brotli input into an out-of-bounds write inside the decoder. The broad reach comes from Brotli being embedded in popular runtimes and HTTP stacks; actual exposure depends on whether an application sends attacker-controlled data into that decoder. Patch affected runtimes and proxies, rebuild embedded deployments, and temporarily disable Brotli decoding for untrusted data where immediate updates are not available.