Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-10271 | Publication Date: 27 October 2026

Critical Out-of-Bounds Write Vulnerability in Google Brotli Decoder
CVE-2026-111497

Summary

A critical buffer overflow vulnerability has been identified in the Google Brotli decoder (versions 1.0.3 through 1.2.0). The flaw, tracked as CVE-2026-111497, carries a CVSS v4.0 score of 9.2 (Critical).

An unauthenticated remote attacker can craft a malicious Brotli-compressed stream that triggers an out-of-bounds write, potentially leading to memory corruption, information disclosure, denial of service, or arbitrary code execution.

Technical Overview

The vulnerability exists in the Brotli decoder implementation (c/dec/decode.c). When processing a specially crafted compressed stream, the decoder can write outside the bounds of its internal buffers, corrupting adjacent memory structures.

Successful exploitation requires that the target application or service decompresses attacker-controlled Brotli data (for example via HTTP Content-Encoding: br, Node.js zlib, or equivalent APIs).

Affected Products

  • Google Brotli: 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1
  • Node.js: Multiple release lines prior to the October 2026 security updates (fixed in 22.23.4, 24.22.1, 26.12.1 and corresponding earlier branches)
  • Python brotli package and other software bundling vulnerable Brotli versions
  • Any application or service that performs Brotli decompression on untrusted input

Recommendations

  1. Immediate Action: Upgrade Google Brotli to version 1.0.10, 1.1.1, or 1.2.1.
  2. Node.js users must update to the latest security releases: 22.23.4, 24.22.1, or 26.12.1 (or later).
  3. Python users should upgrade the brotli package to version 1.2.1 or newer.
  4. Inventory all systems and applications that perform Brotli decompression, especially those accepting external or user-supplied compressed data.
  5. Where immediate patching is not possible, consider temporarily disabling Brotli decompression for untrusted sources as a short-term mitigation.

Support from KSRC

KSRC (Karen IT Security Response Center) is fully prepared to assist organizations with any questions, technical guidance, or incident-related issues arising from this vulnerability.

Whether you require help with impact assessment, mitigation planning, or response coordination, our team is available.

Karen IT
We make the Internet harder to abuse.