This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Google Brotli fixes 1 critical vulnerability

Google Brotli fixes 1 critical vulnerability in versions 1.0.10, 1.1.1 and 1.2.1 [1]. If an update is not possible, it is recommended to block incoming requests with the Content-Encoding: br header at the WAF/proxy level [2]. In Python, the Brotli/brotlicffi packages may be pulled in indirectly through the dependencies of HTTP clients and scanners may not identify them; as a temporary workaround, it is recommended to uninstall them, which makes clients automatically fall back to gzip and deflate [2]. No active exploitation has been reported so far, but unverified PoCs have appeared [3]. Further details, including commands for checking the versions of popular packages/tools that use brotli, can be found at [2]. Individual Linux distribution releases and their fixed versions: Ubuntu [4]: brotli: awaiting evaluation in all versions node.js: vulnerable only in the Focal release, no fixed version has been released yet Debian [5]: brotli: bookworm (security) - 1.0.9-2+deb12u1 trixie (security) - 1.1.0-2+deb13u1 sid - 1.2.0-4.1 python-brotlicffi: sid - 1.2.1.0+ds-1 nodejs: No fixed version has been released yet for the bookworm, trixie, forky and sid releases Red Hat [6]: None of the affected Red Hat products have fixes yet, except for Red Hat Hardened Images (brotli-main) - RHSA-2026:87420 Popular projects that use the Brotli library and their fixed versions: Node.js [7] - 22.23.4, 24.22.1 and 26.12.1 Bun [8] - 1.4.4 .NET [9] - 8.0.33, 9.0.22, 10.0.14 and 11.0.0-rc.3.26522.148 Envoy [10] - 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0 Istio [11] - 1.29.9, 1.30.6 and 1.31.2 Python Brotli [12] - 1.2.1 Python brotlicffi [13] - 1.2.1.0

Google Brotli - RCE, DoS (CVE-2026-111497)
CVSS 9.2 (Critical)

Allows an unauthenticated remote attacker, using a specially crafted data stream compressed with the brotli algorithm, to corrupt the decoder state memory, disclose sensitive memory contents, cause a DoS or execute arbitrary code [1].

The vulnerability is present in products:

  • Google Brotli; >=1.0.3, <1.0.10; >=1.1.0, <1.1.1; >=1.2.0, <1.2.1;
  • Node.js; >=22.0, <22.23.4; >=24.0, <24.22.1; >=26.0, <26.12.1;
  • .NET; >=8.0.0, <8.0.33; >=9.0.0, <9.0.22; >=10.0.0, <10.0.14;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 22. 10. 2026.

By CESNET, z.s.p.o. Ondrej Pavlovič on 26. 10. 2026.

CESNET, z.s.p.o. Logo