CVE-2026-111497

The question isn't whether Brotli is installed. It's whether any of your software decodes Brotli data an outside party controls. Red Hat says environments where nothing decompresses Brotli from untrusted sources aren't affected in practice.

Affected and fixed versions by vendor.

• Brotli library: 1.0.3 to 1.0.9, 1.1.0 and 1.2.0 affected; fixed in 1.0.10, 1.1.1 and 1.2.1 (Google CNA record, GitHub release notes).
• Node.js: 22.x, 24.x and 26.x affected when an application decompresses attacker-supplied data with node:zlib; fixed in 22.23.4, 24.22.1 and 26.12.1 (Oct 21 security release).
• Envoy: 1.39.2, 1.38.5, 1.37.7, 1.36.11 affected; fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12. Envoy says impact is limited to deployments with the Brotli decompressor configured.
• Istio: 1.29.0 to 1.29.8, 1.30.0 to 1.30.5, 1.31.0 to 1.31.1 affected; fixed in 1.29.9, 1.30.6, 1.31.2 (ISTIO-SECURITY-2026-007).
• .NET: .NET 8 runtime and NativeAOT packages fixed in 8.0.33. Microsoft says ASP.NET Core and HttpClient don't decompress Brotli by default and .NET Framework isn't affected. Check Microsoft's advisory for .NET 9 and later.
• Python: PyPI brotli fixed in 1.2.1, brotlicffi in 1.2.1.0 (GHSA-9v8h-qqgm-4m35).
• Palo Alto PAN-OS: 11.2, 12.1 and 12.2 affected on PA-Series and VM-Series firewalls when TLS decryption is enabled on the dataplane and Brotli inspection is on (supported from 11.2.4). 11.1 and 10.2 and Panorama aren't affected, and the management interface isn't exposed. Fixes: 12.2.4-h1, 12.1.7-h11 and 11.2.10-h17 released; 12.1.4-h13, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.13-h4 and 11.2.16-h1 due Oct 27 to 30. Check with show system setting brotli. Palo Alto says it's not aware of malicious exploitation against its products.
• Linux: Debian fixed libbrotli in bookworm (1.0.9-2+deb12u1) and trixie (1.1.0-2+deb13u1). Ubuntu lists fixes for 22.04, 24.04, 26.04 and 26.10, with 16.04 to 20.04 under evaluation. Red Hat lists RHEL 7 through 10 as affected, with errata rolling out.

Checks, in order.

1. Find system Brotli libraries. Debian/Ubuntu: dpkg -l | grep -i brotli. RHEL/Fedora/SUSE: rpm -qa | grep -i brotli. Alpine: apk info -v | grep -i brotli. Compare to your distribution's tracker, not only upstream, because distributions backport (1.0.9-2+deb12u1 is fixed even though 1.0.9 is in the upstream range). Debian and Ubuntu note their Node.js packages and python-brotlicffi use the system library, so patching libbrotli covers them; Red Hat says Node.js 24 and 26 on RHEL 8 and 9 bundle their own copy, so update the nodejs package there.
2. Find bundled and transitive copies. Node.js: node --version against the fixed versions, including Electron-based apps that embed a runtime. Python: pip show brotli brotlicffi. .NET: runtime and NativeAOT package versions against Microsoft's advisory. Search SBOMs and scanner output for brotli, libbrotli, brotlicffi and CVE-2026-111497; statically linked or vendored copies won't show in OS package lists, so scan application artifacts too. Named by third parties but not confirmed by each vendor: Chromium, Firefox and Thunderbird (Red Hat lists these on RHEL), ngx_brotli, the PHP brotli extension, the Ruby brotli gem, Brotli4j, Apache Arrow, ClickHouse, DuckDB, Ghostscript, MuPDF, woff2, libjxl and 7-Zip forks.
3. Find where untrusted Brotli input is decoded. Inbound: services, proxies or middleware that decompress request bodies with Content-Encoding: br, Envoy and Istio decompressor filters, ASP.NET Core request decompression with br enabled, Node.js body parsers. Outbound: HTTP clients that automatically decompress responses from servers you don't control, such as scrapers, webhook fetchers, link previewers, image optimizers and Node.js fetch(). Removing br from Accept-Encoding doesn't stop a server from sending it. Files: WOFF2 font decoders, document and image processors, data-file readers that handle uploads. Code: direct calls to zlib.brotliDecompress(), createBrotliDecompress(), BrotliStream or BrotliDecoder on user-supplied data.
4. Check firewalls that inspect traffic. On PAN-OS 11.2.4 and later, run show system setting brotli; Enabled: yes with TLS decryption on means the dataplane decodes attacker-controlled Brotli.
5. Check containers and internet exposure. Scan images for brotli packages and bundled runtimes, rebuild from patched base images, and prioritize internet-facing services that accept compressed request bodies or fetch arbitrary URLs.

These reduce risk while updates roll out. Test each one.

• Reject or strip Content-Encoding: br on inbound request bodies at the reverse proxy, load balancer or WAF, before anything decompresses them, where your applications don't need Brotli request bodies. Red Hat recommends this. Cover direct-to-origin and alternate routes too.
• Disable automatic Brotli decompression in HTTP clients that fetch untrusted content; keep gzip and deflate if needed. Microsoft's .NET advisory gives configuration examples.
• Envoy and Istio: disable the Brotli decompressor filter for requests and responses. A disabled filter passes encoded bytes onward, so downstream decoders still need protection.
• PAN-OS: until the hotfix is applied, run set system setting brotli-encoding disable and confirm with show system setting brotli, or uncheck Allow Brotli Encoding under Content-ID settings on 12.1.2 and later. With Threat Prevention, Threat ID 97686 (content 9165 or later) gives partial coverage.
• Pause processing of untrusted Brotli files (fonts, archives, documents) on unpatched systems.
• Least privilege and segmentation for services that decode external input, so a compromised process has limited reach.
• EDR coverage on hosts and containers running decoding services, watching for unexpected child processes.

Turning off Brotli response compression on a CDN or web server doesn't disable request or client-side decompression, and request-size limits and WAF rules alone don't cover every decoding path.

• Crashes and segmentation faults in Node.js, Envoy or other decoding processes; repeated restarts; abnormal memory use.
• Spikes in requests carrying Content-Encoding: br, especially from new sources.
• Decoding services spawning shells or unexpected child processes.
• On PAN-OS, Threat ID 97686 hits where Threat Prevention is licensed.

Am I exposed to CVE-2026-111497?

You're exposed if software you run uses Brotli 1.0.3 through 1.2.0, or an unpatched bundled copy, and decodes Brotli data from an untrusted source such as compressed request bodies, fetched web content or uploaded files. Having Brotli installed without decoding untrusted input isn't a practical exposure, according to Red Hat.

Is there a patch for the Brotli vulnerability?

Yes. Google Brotli 1.0.10, 1.1.1 and 1.2.1 fix it. Node.js 22.23.4, 24.22.1 and 26.12.1, Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12, Istio 1.31.2, 1.30.6 and 1.29.9, .NET 8.0.33, the PAN-OS hotfixes, and Debian and Ubuntu package updates include the fix. Check each product that bundles Brotli for its own update.

How do I mitigate CVE-2026-111497 without patching?

Stop decoding untrusted Brotli data. Reject Content-Encoding: br on inbound requests before decompression, disable automatic Brotli decompression in clients and proxies, disable Brotli inspection on affected PAN-OS firewalls, and pause untrusted Brotli file processing. Test each change, then patch.

Is CVE-2026-111497 being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on October 27, 2026, which means CISA has evidence of exploitation, with a federal due date of November 10. Red Hat reports public proof-of-concept code that causes crashes and had not seen a reliable public code-execution exploit as of October 26. Imperva published a write-up on October 23 showing code execution on the official Node.js 24.22.0 Linux arm64 image, not reliable on every attempt. Palo Alto says it isn't aware of exploitation against its products.

Oct 27, 2026. First published, the day CISA added the CVE to KEV. Includes Palo Alto's PAN-OS advisory (updated Oct 27) and Istio's fixed versions.

• CISA Known Exploited Vulnerabilities catalog
• NIST NVD: CVE-2026-111497
• Google Brotli v1.2.1 release
• Node.js October 2026 security releases
• Envoy advisory GHSA-3wvj-j6qm-62mr
• Istio security bulletin ISTIO-SECURITY-2026-007
• Microsoft .NET advisory for CVE-2026-111497
• GitHub advisory GHSA-9v8h-qqgm-4m35 (brotli and brotlicffi on PyPI)
• Palo Alto Networks: impact of CVE-2026-111497 on PAN-OS
• Red Hat bulletin RHSB-2026-015 and Red Hat CVE page
• Debian security tracker and Ubuntu CVE tracker
• Imperva: Node2Shell, from Brotli data to remote code execution
• Patch the Planet: Brotli