Criminals Are Actively Exploiting a Flaw in the Brotli Compression Tool Used by Millions of Websites
A memory-corruption bug in Google's Brotli compression library has been added to the US government's active-exploitation watchlist, and honeypot sensors have already logged real attack attempts in the wild.
Key points
- CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue, confirming the flaw is being used in real attacks.
- The bug affects Google Brotli versions 1.0.3 through 1.2.0, a file-compression tool baked into millions of websites and used by default in Node.js.
- A successful attack can steal sensitive data, crash a server, or let a criminal run their own code on a victim machine without needing a password or login.
- Safe versions are 1.0.10, 1.1.1, and 1.2.1. Any server still running an in-between version is exposed right now.
- SecurityWeek first reported that two honeypot operators logged attempts to exploit the flaw, including at least one using a broken, unfinished exploit.
Brotli is a compression tool made by Google. Compression tools shrink files before sending them across the internet, the same way a zip file squashes a folder before you email it. Brotli is fast, widely trusted, and built directly into Node.js, a popular platform developers use to build web applications. That ubiquity is what makes CVE-2026-111497 alarming. We first covered this flaw on 23 October in "Critical Brotli Flaw Lets Attackers Run Code on Node.js Servers", when researchers already had a working exploit scoring 9.2 on the severity scale.
The flaw is a buffer overflow: a condition where a specially crafted piece of data is fed to the decoder, the part of the software that unpacks compressed content, and the data spills out of the memory space it was supposed to occupy. That spill can corrupt neighbouring memory, expose private contents, crash the service entirely, or let the sender run their own instructions on the target machine. No credentials required, and no employee needs to click anything.
Palo Alto Networks published its own advisory on 26 October 2026, noting it's still investigating which of its own products are affected. The company confirmed the vulnerable range is Brotli 1.0.3 through 1.2.0 on all platforms.
Which versions are affected?
Any system running Brotli 1.0.3 through 1.2.0 is at risk. The table below shows the vulnerable range and each available fix.
| Branch | Last vulnerable version | Safe version |
|---|---|---|
| 1.0.x | 1.0.9 | 1.0.10 |
| 1.1.x | 1.1.0 | 1.1.1 |
| 1.2.x | 1.2.0 | 1.2.1 |
Node.js ships Brotli as part of its core, so any application running on an unpatched Node.js build inherits the flaw automatically. Web servers and API backends that handle compressed HTTP traffic are the most exposed.
Should website owners and their customers be worried?
Yes, if the site runs unpatched Brotli. Visitors themselves have no patch to apply, but the risk is real: a criminal who exploits this flaw on a web server could read data the server holds, including customer records. If you run a website or application, check your Brotli version today and update it.
The honeypot data deserves attention even though one of the observed attempts used a broken exploit. Broken exploits get fixed. Attackers are already probing, which means the race between criminal development and patching is live, not theoretical.
Federal agencies in the United States have no choice: CISA's Known Exploited Vulnerabilities catalogue requires them to treat actively exploited flaws on publicly exposed assets as a priority. Private organisations aren't legally bound, but the same logic applies. The date this hits KEV is the moment foot-dragging stops being a policy decision and starts being a liability.
