Brotli Vulnerability Now Exploited: What to Patch

You may have patched Node.js last week and moved on. Now the Brotli vulnerability is back in the news, because CISA says it is being exploited. That changes how urgent it is, and it means Node.js is only one place to look.

What changed on 27 October

On 27 October 2026 CISA added two entries to its Known Exploited Vulnerabilities (KEV) catalog. Its alert says the additions are "based on evidence of active exploitation". One is CVE-2026-111497, an "unchecked return value" flaw in Google's Brotli compression library. The other is an Adobe Commerce and Magento bug, covered below.

The KEV data describes the Brotli flaw like this: a remote, unauthenticated attacker could corrupt the decoder's memory, disclose memory, cause a denial of service, or potentially run code, using a crafted Brotli stream. The entry also notes that Brotli is an open-source library used by many different products.

Here is what CISA does not say. It does not name the products that were attacked, and it lists ransomware use as "Unknown". Do not assume your Node.js servers were the target, and do not assume they were not. Treat every product that bundles Brotli as in scope.

Does the 10 November date apply to you?

The KEV data gives a due date of 10 November 2026. That date comes from the JSON feed, not the alert page. It binds US federal civilian agencies under CISA's BOD 26-04. For everyone else, it is guidance: CISA encourages all organisations to prioritise KEV entries. Most teams should treat the date as a reasonable deadline anyway, because "known to be exploited" is the strongest signal a vulnerability list can give.

Why the Brotli vulnerability reaches beyond Node.js

Brotli is a compression format used for web responses. Many programs decode it with the same C library, so one bug appears in many places. Node.js published its fixes on 21 October in 22.23.4, 24.22.1 and 26.12.1, and rates the issue High. For the Node.js details, see our earlier post, tech news this week, October 2026. The Node.js security post explains the root cause: the decoder treated an invalid block switch as a need for more input and kept writing into an eight-byte internal buffer.

The upstream project released fixes on 21 October in v1.0.10, v1.1.1 and v1.2.1. Anything that vendors or links an older copy needs the update.

Check these stacks

As of 28 October 2026, these are the fixes we could confirm. Vendor lists are still changing, so check each source again before you close a ticket.

Two notes on the partly verified rows. The PyPI page confirms version 1.2.1 and its date. That it fixes this CVE is our inference from the upstream release. The .NET release index confirms the versions and dates but does not name the CVE; the link to Brotli comes from secondary sources, so read Microsoft's own notes before you rely on it.

The Bun advisory is the clearest example of a trap: a compiled executable carries its own runtime. Updating Bun on your laptop does nothing for a binary you shipped last month.

A short patch checklist

1. List every runtime and base image that serves or reads web traffic. Include build servers and scheduled jobs that fetch compressed content.
2. Search lockfiles and vendored folders for Brotli. Python's Brotli, native add-ons and copied C sources are the usual hiding places.
3. Upgrade, then rebuild. Compiled binaries, containers and serverless bundles all need a new build, not just a new package on the host.
4. Redeploy and confirm the version from the running process, not only from your repository.
5. Check logs around Brotli-decoding services for crashes or restarts since 21 October. CISA asks KEV users to follow forensic triage requirements, so keep what you find.
6. Write down what you could not fix and why, with an owner and a date.

A stop-gap, not a fix

If you cannot patch a service today, one option is to reject incoming requests that use Content-Encoding: br, at your proxy or load balancer. This is our own suggestion, not vendor advice, and we have not tested it against every product. It only helps where the risky path is decoding Brotli that clients send you. It does nothing for services that decode Brotli from responses they fetch. Use it to buy a few days, then patch.

The Adobe entry: old patch, new urgency

The second KEV addition is CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento. Do not mistake it for a new release. Adobe's bulletin, APSB26-73, dates from July 2026. Only the KEV listing is new. We could not open the bulletin itself, so check it directly for the details.

Adobe's support article lists the isolated patches for 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18. Your store must already be on the latest patch level of its line, and cloud merchants use the cloud patches. That article does not name this CVE and points to the bulletin, so confirm that the patch you apply matches it. If you run a store that missed the July update, it is now a priority.

What to do next

Start with an inventory, because you cannot patch what you have not found. Work through the checklist today, aim to finish before 10 November, and recheck vendor pages as they update.

If you want help auditing a stack or rebuilding and redeploying safely, look at our work or get in touch.