Is CVE-2026-111497 exploited in the wild?

Yes. CVE-2026-111497 is known to be exploited in the wild, first recorded on 27 October 2026. Treat it as urgent.

How severe is CVE-2026-111497?

Critical severity, with a CVSS score of 4, published 22 October 2026.

Which products and versions are affected?

github.com/andybalholm/brotli (Go) SEMVER:introduced=0,fixed=1.2.7; Google Brotli 1.0.3 through 1.2.0; Node.js 22.x, 24.x, 26.x (affected versions unspecified); brotli (PyPI) ECOSYSTEM:introduced=0,fixed=1.2.1, ECOSYSTEM:introduced=1.0.3,fixed=1.2.1; and 1 more.

Is there a fix for CVE-2026-111497?

Yes. github.com/andybalholm/brotli (Go): upgrade to 1.2.7 or later; brotli (PyPI): upgrade to 1.2.1 or later; brotlicffi (PyPI): upgrade to 1.2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111497 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111497?

Check whether you run Amazon AWS, github.com/andybalholm/brotli (Go), Google Brotli or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111497: Google Brotli buffer overflow in decoder

CVE-2026-111497 · Severity: critical · CVSS 4 · Exploited in the wild · Published 2026-10-22

Google Brotli is a compression library used in web servers, browsers, and other applications. A buffer overflow flaw in the Brotli decoder allows attackers who send a specially crafted compressed stream to corrupt memory, leak sensitive data, cause the application to crash, or potentially run malicious code—with no authentication required.

Technologies: Amazon AWS, Google Brotli, Google Cloud Platform, brotli (PyPI). Vendors: Amazon, Go, Google, PyPI.

Quick answers

Is CVE-2026-111497 exploited in the wild?: Yes. CVE-2026-111497 is known to be exploited in the wild, first recorded on 27 October 2026. Treat it as urgent.
How severe is CVE-2026-111497?: Critical severity, with a CVSS score of 4, published 22 October 2026.
Which products and versions are affected?: github.com/andybalholm/brotli (Go) SEMVER:introduced=0,fixed=1.2.7; Google Brotli 1.0.3 through 1.2.0; Node.js 22.x, 24.x, 26.x (affected versions unspecified); brotli (PyPI) ECOSYSTEM:introduced=0,fixed=1.2.1, ECOSYSTEM:introduced=1.0.3,fixed=1.2.1; and 1 more.
Is there a fix for CVE-2026-111497?: Yes. github.com/andybalholm/brotli (Go): upgrade to 1.2.7 or later; brotli (PyPI): upgrade to 1.2.1 or later; brotlicffi (PyPI): upgrade to 1.2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111497 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111497?: Check whether you run Amazon AWS, github.com/andybalholm/brotli (Go), Google Brotli or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/andybalholm/brotli (Go): upgrade to 1.2.7 or later
```
go get github.com/andybalholm/brotli@v1.2.7
```
brotli (PyPI): upgrade to 1.2.1 or later
```
pip install "brotli>=1.2.1"
```
brotlicffi (PyPI): upgrade to 1.2.1.0 or later
```
pip install "brotlicffi>=1.2.1.0"
```

Technical details

A buffer overflow exists in c/dec/decode.c of the Brotli decoder, triggered when processing a malicious Brotli-compressed stream. The vulnerability is reachable over the network via any application that decompresses untrusted Brotli data, permitting out-of-bounds writes that corrupt adjacent decoder state, disclose memory, or achieve code execution. The flaw affects versions 1.0.3 through 1.2.0 across all platforms.

Affected products

Google Brotli 1.0.3 through 1.2.0
Node.js Node.js 22.x, 24.x, 26.x (affected versions unspecified)

Identifiers

CVE-2026-111497
BIT-BROTLI-2026-111497
BIT-DOTNET-2026-111497
BIT-DOTNET-SDK-2026-111497
BIT-NODE-2026-111497
BIT-NODE-MIN-2026-111497
BIT-POWERSHELL-2026-111497
GHSA-9v8h-qqgm-4m35
GHSA-c9gr-gmg4-2vqv
GO-2026-6888
PYSEC-2026-4322
PYSEC-2026-4323

Timeline

2026-10-21: disclosed

References

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.