CISA added CVE-2026-111497, a flaw in Google's Brotli decoder, to its Known Exploited Vulnerabilities catalog on October 27. Organizations running affected Node.js applications should prioritize the runtime update and check both incoming compressed requests and compressed responses consumed from other servers.

What the evidence establishes

Node.js disclosed the decoder issue on October 21. Malformed Brotli data can cause an out-of-bounds write when an application decompresses it, potentially producing a crash, memory disclosure or remote code execution. Fixed releases are 22.23.4, 24.22.1 and 26.12.1; deploy those or newer fixed versions in the appropriate supported line.

Imperva's October 22 independent tests demonstrated code execution using the official Node.js 24.22.0 Linux arm64 image. Tested routes included built-in fetch() consuming a compressed response and configured Express/body-parser request parsers. The same input was rejected by 24.22.1. Execution required multiple attempts; the researchers did not test every build or application. Merely receiving a request does not make a bare Node HTTP server decode its Brotli body.

The current CISA listing establishes known exploitation, superseding earlier metadata that did not report it. It does not identify a campaign, victim count or actor; ransomware use is listed as unknown. A working research demonstration and a government exploitation designation are different kinds of evidence.

Check the decoder beyond Node.js

Google's CNA record identifies affected Brotli ranges as 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. Use the component or product supplier's fixed package, including backport guidance. The CVE record was published October 22 but separately carries a February 27 public-date field; these are not evidence of attacks beginning on either date.

Bulwark response priorities

  • Inventory what is running. Find Node binaries and embedded Brotli components in deployed containers, appliances and application bundles. Record the runtime inside the production artifact, not only the version on a build machine.
  • Update and replace old instances. Rebuild affected images, redeploy services and verify that workers actually restarted into fixed runtimes. Updating an application dependency alone may leave its bundled decoder unchanged.
  • Map both directions. Review inbound body inflation and services fetching third-party content. An internet-facing firewall is not the only relevant boundary when an internal worker decompresses external responses.
  • Constrain exposure during rollout. Where practical, temporarily limit untrusted Brotli decoding on affected paths and validate normal application behavior. Treat traffic controls as interim containment, not proof that the runtime is repaired.
  • Investigate with context. Preserve application and process records. Unexpected decoder errors or exits warrant correlation with runtime version and input source; they are not stand-alone proof of exploitation. Review process privileges and accessible secrets if compromise is suspected.

Bulwark assessment

For lean teams and government contractors, the operational risk sits below the application code: a routine content-decoding step can reach native memory-unsafe logic. Close the runtime gap, verify the deployed result and retain enough telemetry to distinguish a blocked malformed input from a compromised process.

Original sources

CISA KEV catalog; Node.js October 21 security releases; Imperva's independent Node2Shell tests; Google CNA record.