Exploited vulnerabilities · Briefing
Brotli CVE-2026-111497 enters CISA KEV as defenders trace bundled decoders
Reported exploitation makes Brotli patching urgent. Defenders need to find vulnerable decoders inside applications, runtimes and development tools, then verify which copies actually process untrusted data.
Kinwilder research desk · · AI-assisted analysis
What is established
Brotli’s CVE-2026-111497 now carries reported exploitation and a CISA Known Exploited Vulnerabilities catalogue entry. Defenders should care because the decoder can sit inside software beyond Node.js. Help Net Security’s 27 October 2026 report describes an out-of-bounds write with possible crashes, memory disclosure or remote code execution; it dates Node.js’s public disclosure to 21 October 2026.
In its 27 October update to an advisory dated 26 October, Canada’s Cyber Centre reports CISA’s same-day catalogue addition. Affected ranges start at 1.0.3, 1.1.0 and 1.2.0, ending before the respective fixed releases: 1.0.10, 1.1.1 and 1.2.1. Help Net Security identifies those releases as carrying the fix.
Socket’s 26 October report explains that Bun automatically decompresses Brotli HTTP responses, while Python Requests does so when an optional Brotli dependency is installed. In a 26 October oss-security message, Harry Sintonen also identifies Git’s HTTPS helper as affected when its libcurl has Brotli support. These are conditional exposure paths, requiring assessment of the actual build and inputs.
Who is behind it
Attribution is not established. Help Net Security reports ELLIO’s observation of exploitation traffic and its assessment that an operator pursuing mass exploitation had adopted the flaw. That assessment supplies no named group, affiliate, state association or operator location.
Our analysis
Analysis: The failed boundary is between compressed input and the memory of the process decoding it. A decoder must keep writes within allocated buffers even when its input is hostile. Here, decompression can turn an ordinary data-handling operation into memory corruption.
The exposure question therefore has two parts: does a workload contain a vulnerable decoder, and can an untrusted party influence data reaching it? An inbound service accepting compressed content deserves attention, but so does an application fetching responses from outside its control. Outbound connectivity does not make returned content trustworthy.
Analysis: Dependency inventories may understate this problem when they describe source packages without describing deployed binaries. Teams should expect uncertainty around compiled applications, inherited container layers and tools installed outside their normal release process. This is an assessment priority, not evidence that every such installation is exploitable.
Watch next for downstream advisories that clarify reachable functionality, supported fixes and deployment requirements. A package’s presence establishes a question to investigate; it does not establish a successful intrusion.
Defensive actions
-
Find reachable copies first. Kinwilder recommends mapping internet-facing services, HTTP clients and build workers that decompress external content. Record the application owner, decoder provenance, runtime version and whether the input source can be influenced externally. Keep inventory gaps visible rather than treating missing data as clearance.
-
Replace the component that ships. Use the fixed Brotli releases above or the relevant downstream vendor’s corrected package. Socket reports Bun’s update in 1.4.4 and explains that compiled Bun executables require rebuilding. Its guidance also distinguishes bundled copies from system libraries and notes that shared-library consumers may need restarting. Kinwilder recommends recording deployment evidence for each workload.
-
Inspect client configuration. Sintonen advises checking both
CURLOPT_ENCODINGand its aliasCURLOPT_ACCEPT_ENCODINGwhen reviewing libcurl users. Kinwilder recommends checking Git installations on automation workers alongside application dependencies, then confirming their linked library builds. -
Hunt for consequences and preserve context. Kinwilder recommends correlating application crashes, memory-fault reports, HTTP transaction metadata and endpoint process telemetry. Investigate unexpected child processes or outbound connections associated with decoding workloads. These are investigative leads, not supplied detection signatures; their absence cannot establish that exploitation did not occur.
Key concepts
- Decoder: Software that reconstructs original data from compressed input. Receiving data and decoding it are separate processing steps.
- Out-of-bounds write: A program writes beyond a memory area it is permitted to use, potentially damaging nearby process state.
- Bundled dependency: A library or runtime delivered inside another product. Its replacement follows that product’s packaging and release process.
Limits
The packet identifies no confirmed victims, sectors or victim countries. The Git exposure report is a researcher’s mailing-list statement; exploitation telemetry reaches this briefing through secondary reporting. Campaign scale, successful compromises and environment-specific exploitability remain unknown. Kinwilder did not reproduce the vulnerability, test fixes or independently validate the reported attacks.
Kinwilder briefing: AI-written analysis of public reporting, checked in a separate AI review against the linked sources. No human expert review or independent reproduction is implied.