ReconXWatchtower

Where this stands

First reported 23/10/2026 10:20

  1. 1Unconfirmed reportnot observed
  2. 2Corroboratednot observed
  3. 3Confirmed now23/10/2026 10:20Community post
  4. 4Exploitednot yet

Unconfirmed report and Corroborated were never seen on its own: the first report we had was already stronger.

Brotli library out-of-bounds write (CVE-2026-111497): Brotli 1.2.1 released, software bundling Brotli (Node.js, Bun, Envoy, Istio, Python) needs updating

Node.js · Critical

CVE-2026-111497

Published 24/10/2026 20:55

Timeline

2 events over 1 d 10 h

  1. 23/10/2026 10:20ConfirmedCommunity post+1 d 10 h
  2. 24/10/2026 20:55Published on WatchtowerPro CISO

In short

An out-of-bounds write in the Brotli C decompression library (CVE-2026-111497) is reported to allow remote code execution. Brotli 1.2.1 has been released. Software that bundles Brotli, including Node.js, Bun, Envoy Proxy, Istio and the Python brotli packages, needs updating. Exploitation in the wild has not been reported.

Affected versions

  • The Brotli C library, in versions before 1.2.1.
  • Software that bundles or uses Brotli and has released updates, according to patchtheplanet.org: Node.js, Bun, Envoy Proxy and Istio. The Python brotli packages on PyPI are also reported as affected (Aikido). Other software that embeds Brotli may be affected too.
  • An unverified GitHub page earlier claimed these Node.js versions: below 22.23.4, below 24.22.1 and below 26.12.1, with the flaw in deps/brotli/c/dec/decode.c.
  • Claimed exposure: any service that decompresses untrusted Brotli data, for example an API accepting Content-Encoding: br request bodies, with no authentication needed. Not confirmed.

Fixed in

  • Brotli library: version 1.2.1 has been published (github.com/google/brotli, tag v1.2.1).
  • Node.js, Bun, Envoy Proxy and Istio: patchtheplanet.org reportedly lists releases that include the fix. The exact fixed versions per product were not confirmed.
  • An unverified third-party page earlier claimed Node.js 22.23.4, 24.22.1 and 26.12.1. Check these against the official Node.js release notes.
  • The Python brotli packages: a fixed version was not stated.

What to do now

  • Update Brotli to 1.2.1 or later where you use it directly.
  • Update Node.js, Bun, Envoy Proxy and Istio to the release that includes the Brotli fix. Take the exact version numbers from each project's official release notes, not from third-party pages.
  • Check the Python brotli packages and any other software that bundles Brotli, such as container images and vendored copies.
  • Before sending customers an advisory, confirm the CVE and the fixed versions against the official CVE record and the vendor release notes.
  • Developers and hosting providers can find services that accept Brotli-compressed input, such as Content-Encoding: br request bodies, or that call zlib.brotliDecompress.
  • An interim measure, such as refusing Brotli-encoded request bodies, only reduces exposure. It does not make a server safe.

ReconX customers see the full notice - and their own systems

Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.

In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 2 sources with their dates. And technology matching: which of your systems run Node.js, at which version, fixed or not - and what each one needs.

Sign in to ReconXAbout ReconX

Main sources

Re: Brotli CVE-2026-111497 Research · cR0w Community

← All Watchtower notices

Pro CISO publishes ReconX Watchtower notices from public sources so organisations can act early. A notice describes an issue, never any organisation's systems. Times are Amsterdam time. Report a vulnerability in our systems.

ReconX Watchtower opened to the public on 24 October 2026, in the wake of PHP2Shell - our contribution to a safer digital ecosystem.