home / blog
2026-10-22 · critical
Brotli: buffer overflow in the decoder, remote code execution (CVE-2026-111497)
Buffer overflow in Google's Brotli decoder, CVSS v4.0 9.2. Also affects Node.js and libraries that embed it: update Brotli.
On 22 October 2026 the record for CVE-2026-111497 was published: a buffer overflow in Google's Brotli decoder, present in versions 1.0.3 through 1.2.0. A remote unauthenticated attacker can use a crafted compressed stream to corrupt adjacent decoder memory. Google rates it CVSS v4.0 9.2.
The issue is not limited to one application: Brotli is embedded in many products. Node.js published fixes in its October 2026 security release, and the Python brotli and brotlicffi packages have dedicated fixed versions.
Update Brotli to 1.0.10, 1.1.1 or 1.2.1, or the library that embeds it. Check transitive dependencies of your projects, since Brotli often arrives from a third-party library rather than as a direct dependency.
At a glance
- What
- Buffer overflow in Google's Brotli decoder, remotely triggerable with a crafted compressed stream. Consequences may include memory corruption, data disclosure, denial of service or code execution.
- Severity
- CVSS v4.0 9.2 (critical), according to Google as CNA. NVD does not report CVSS v3.1.
- Affected versions
- Brotli from 1.0.3 up to and including 1.2.0.
- Fix
- Brotli 1.0.10, 1.1.1 and 1.2.1. Node.js published fixes in its October 2026 security release.
- Action
- Update Brotli or the libraries that embed it (Node.js, Python packages, curl built with Brotli). Also check transitive dependencies.
Sources: NVD, CVE-2026-111497 · Google Brotli, release 1.2.1 · Node.js, release di sicurezza di ottobre 2026