# Brotli Vulnerability Now Exploited: What to Patch

CISA now lists a Brotli vulnerability as exploited. Here is what changed on 27 October, which runtimes and libraries to check beyond Node.js, and a short checklist to work through.

Published 2026-10-28. 5 min read. Category: Web development. By Mutahar Aslam, Founder & CEO of Paraline Tech.

## Key takeaways

- On 27 October 2026 CISA added the Brotli flaw CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
- The fix exists upstream in Brotli 1.0.10, 1.1.1 and 1.2.1, so check every place Brotli lives, not only Node.js.
- Programs built with a bundled runtime, such as Bun compiled executables, stay affected until you rebuild them.
- The KEV due date of 10 November is binding only for US federal agencies, but it is a sensible target for everyone.

You may have patched Node.js last week and moved on. Now the Brotli vulnerability is back in the news, because CISA says it is being exploited. That changes how urgent it is, and it means Node.js is only one place to look.

## What changed on 27 October

On 27 October 2026 CISA added two entries to its Known Exploited Vulnerabilities (KEV) catalog. Its [alert](https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog) says the additions are "based on evidence of active exploitation". One is CVE-2026-111497, an "unchecked return value" flaw in Google's Brotli compression library. The other is an Adobe Commerce and Magento bug, covered below.

The [KEV data](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) describes the Brotli flaw like this: a remote, unauthenticated attacker could corrupt the decoder's memory, disclose memory, cause a denial of service, or potentially run code, using a crafted Brotli stream. The entry also notes that Brotli is an open-source library used by many different products.

Here is what CISA does not say. It does not name the products that were attacked, and it lists ransomware use as "Unknown". Do not assume your Node.js servers were the target, and do not assume they were not. Treat every product that bundles Brotli as in scope.

## Does the 10 November date apply to you?

The KEV data gives a due date of 10 November 2026. That date comes from the JSON feed, not the alert page. It binds US federal civilian agencies under CISA's BOD 26-04. For everyone else, it is guidance: CISA encourages all organisations to prioritise KEV entries. Most teams should treat the date as a reasonable deadline anyway, because "known to be exploited" is the strongest signal a vulnerability list can give.

## Why the Brotli vulnerability reaches beyond Node.js

Brotli is a compression format used for web responses. Many programs decode it with the same C library, so one bug appears in many places. Node.js published its fixes on 21 October in 22.23.4, 24.22.1 and 26.12.1, and rates the issue High. For the Node.js details, see our earlier post, [tech news this week, October 2026](/blog/tech-news-this-week-october-2026). The [Node.js security post](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) explains the root cause: the decoder treated an invalid block switch as a need for more input and kept writing into an eight-byte internal buffer.

The upstream project [released fixes](https://github.com/google/brotli/releases) on 21 October in v1.0.10, v1.1.1 and v1.2.1. Anything that vendors or links an older copy needs the update.

## Check these stacks

As of 28 October 2026, these are the fixes we could confirm. Vendor lists are still changing, so check each source again before you close a ticket.

| Stack | What to do | Confidence |
|---|---|---|
| Node.js | Upgrade to 22.23.4, 24.22.1 or 26.12.1 | Verified |
| Bun | Upgrade to 1.4.4 or later (affected: 1.0.21 up to but not including 1.4.4) | Verified |
| Bun compiled executables | Rebuild after upgrading; `bun build --compile` output stays affected until then | Verified |
| Python `Brotli` package | Upgrade to 1.2.1, released 22 October | Partly verified |
| .NET | Update to the latest patch: 8.0.33, 9.0.22 or 10.0.14, released 25 October | Partly verified |
| Direct use of the C library | Move to 1.0.10, 1.1.1 or 1.2.1, matching your branch | Verified |

Two notes on the partly verified rows. The [PyPI page](https://pypi.org/project/Brotli/) confirms version 1.2.1 and its date. That it fixes this CVE is our inference from the upstream release. The [.NET release index](https://github.com/dotnet/core/blob/main/release-notes/releases-index.json) confirms the versions and dates but does not name the CVE; the link to Brotli comes from secondary sources, so read Microsoft's own notes before you rely on it.

The Bun [advisory](https://github.com/oven-sh/bun/security/advisories/GHSA-663w-cv8g-jj2p) is the clearest example of a trap: a compiled executable carries its own runtime. Updating Bun on your laptop does nothing for a binary you shipped last month.

## A short patch checklist

1. **List every runtime and base image** that serves or reads web traffic. Include build servers and scheduled jobs that fetch compressed content.
2. **Search lockfiles and vendored folders** for Brotli. Python's `Brotli`, native add-ons and copied C sources are the usual hiding places.
3. **Upgrade, then rebuild.** Compiled binaries, containers and serverless bundles all need a new build, not just a new package on the host.
4. **Redeploy and confirm the version** from the running process, not only from your repository.
5. **Check logs** around Brotli-decoding services for crashes or restarts since 21 October. CISA asks KEV users to follow forensic triage requirements, so keep what you find.
6. **Write down what you could not fix** and why, with an owner and a date.

## A stop-gap, not a fix

If you cannot patch a service today, one option is to reject incoming requests that use `Content-Encoding: br`, at your proxy or load balancer. This is our own suggestion, not vendor advice, and we have not tested it against every product. It only helps where the risky path is decoding Brotli that clients send you. It does nothing for services that decode Brotli from responses they fetch. Use it to buy a few days, then patch.

## The Adobe entry: old patch, new urgency

The second KEV addition is CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento. Do not mistake it for a new release. Adobe's bulletin, [APSB26-73](https://helpx.adobe.com/security/products/magento/apsb26-73.html), dates from July 2026. Only the KEV listing is new. We could not open the bulletin itself, so check it directly for the details.

Adobe's [support article](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421) lists the isolated patches for 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18. Your store must already be on the latest patch level of its line, and cloud merchants use the cloud patches. That article does not name this CVE and points to the bulletin, so confirm that the patch you apply matches it. If you run a store that missed the July update, it is now a priority.

## What to do next

Start with an inventory, because you cannot patch what you have not found. Work through the checklist today, aim to finish before 10 November, and recheck vendor pages as they update.

If you want help auditing a stack or rebuilding and redeploying safely, look at our [work](https://paralinetech.com/work) or [get in touch](https://paralinetech.com/contact).

## Common questions

### Does the KEV due date apply to my company?

Not legally. The 10 November 2026 date applies to US federal civilian agencies. CISA does encourage all organisations to prioritise KEV entries, so it is a useful internal deadline.

### Is Node.js the product that was attacked?

We do not know. CISA lists the Brotli library and does not say which products were targeted. Node.js is one of several runtimes that ship a fix.

### Is the Adobe Commerce and Magento flaw new?

No. The patch (APSB26-73) came out in July 2026. What is new is that CVE-2026-48356 is now listed as exploited.

### Can I just block Brotli requests?

It may reduce exposure as a stop-gap, but it is not a fix and no vendor recommends it in the sources we checked. Patch and rebuild.

Canonical page: https://blog.paralinetech.com/brotli-flaw-exploited-patch-guide