Google Brotli CVE-2026-111497: critical flaw already exploited

What it is and who is affectedGoogle Brotli is a compression library used far beyond browsers: it sits inside web servers, content delivery layers, pr...

What it is and who is affected

Google Brotli is a compression library used far beyond browsers: it sits inside web servers, content delivery layers, proxies, Node.js runtimes and countless applications that decompress data received from the network. The National Vulnerability Database (NVD) of NIST describes CVE-2026-111497 as a buffer overflow in the Brotli decoder (c/dec/decode.c) affecting Google Brotli versions 1.0.3 through 1.2.0 on all platforms. The underlying weakness is classified as CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write).

According to CISA, the flaw stems from an unchecked return value that lets a remote, unauthenticated attacker corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code by sending a crafted Brotli-compressed stream. In plain terms: anyone who can reach a service that decompresses Brotli data may be able to trigger it without credentials. The NVD published the record on 22 October 2026 and rates it CVSS 4.0 9.2, critical.

For small and mid-sized companies in Spain the exposure is easy to overlook, because Brotli is rarely installed on purpose. It arrives as a dependency of a web stack, a Node.js service, a reverse proxy or a CMS module. If your team manages its own servers or a WordPress, PrestaShop or Joomla installation with a customised stack, the library may be present in several places at once, in different versions.

Why it is urgent: it is already being exploited

This is not a theoretical bug waiting for a proof of concept. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalogue on 27 October 2026, which means there is evidence of exploitation in real attacks. The agency gave US federal agencies until 10 November 2026 to apply mitigations in line with vendor instructions and its risk-based patching guidance, including evaluating each asset's internet exposure.

The material does not record known use in ransomware campaigns, and that detail should not invite complacency: the KEV listing alone means the window between disclosure and active abuse has already closed. A critical memory-corruption flaw in a decompression routine is attractive to attackers precisely because it can be reached through ordinary traffic and leaves room for both data disclosure and code execution.

What to do today

Inventory first. Find every place where Brotli is present: server packages, container images, Node.js services, bundled binaries and third-party components. Record the exact version of each one.
Identify the affected range. Anything between 1.0.3 and 1.2.0 is in scope. The material states that libraries and binaries in that range should be updated to the latest available version: 1.0.10, 1.1.1 or 1.2.1. Where a component bundles its own copy, follow the vendor's advisory rather than assuming the system package update covers it.
Apply the vendor guidance. Use the fixed release indicated in each manufacturer's advisory, and treat Node.js and other runtimes through their own security releases. If no mitigation is available for a given asset, CISA's position is to discontinue use of the product.
Look for signs of intrusion. Review logs for unusual crashes or restarts of services that decompress data, unexpected outbound connections, anomalous memory behaviour and any unexplained access to sensitive data. A denial-of-service pattern or a service that dies repeatedly under specific requests deserves a closer look.
Reduce what is exposed to the internet. Restrict management interfaces, proxies and internal services that do not need public reachability, and keep an inventory of which assets answer from outside your network — the same exercise CISA asks agencies to document.

Document the versions found, the update applied and the date, both for internal traceability and for the record-keeping that GDPR accountability expects when a security incident is assessed.

How a cybersecurity team such as ALMC's can help

Keeping track of a dependency like Brotli across a handful of servers, a WordPress site, a PrestaShop shop and a small IT team is exactly the kind of work that slips between priorities. At ALMC we start from an audit of what is actually running — versions, exposed services, bundled libraries — and from penetration testing that shows which of those surfaces can be reached from outside. From there we harden servers, apply and verify security patches, monitor for suspicious behaviour and respond to incidents when something does go wrong. We also maintain and update WordPress, PrestaShop and Joomla installations and repair websites that have already been compromised. The goal is simple: close the vulnerabilities before someone else finds them, and know quickly if anything has changed.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.