Brotli's decoder bug is on KEV: patch every stack that ships the library

CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog on October 27, 2026, in the same batch as Magento’s PolyShell upload bug. Federal civilian agencies have until November 10, 2026 under Binding Operational Directive 26-04. Everyone else who decompresses Brotli on the way into a process is on the same calendar, whether or not they know the library is there.

The bug sits in Google’s Brotli decoder. Public records describe an unchecked return value that lets a remote, unauthenticated party feed a compressed stream and corrupt adjacent decoder state. The catalog language covers memory disclosure, denial of service, and potential code execution. Ubuntu’s CVE page puts the affected decoder builds at 1.0.3 through 1.2.0 and points operators at 1.0.10, 1.1.1, or 1.2.1. That is the root fix. Everything else is a question of which binary you actually run.

The library is not the only package

Brotli is a compression format. The C library is the reference. Runtimes and proxies ship their own copies. Public advisories and vendor notes have tied the same decoder class of failure to Node.js releases, Bun, Envoy and Istio data planes, Python’s Brotli and brotlicffi wheels, and .NET System.IO.Compression builds that needed their own updates. Distros have been backporting into libbrotli packages on Debian, Ubuntu, Alpine, and others at different speeds.

Inventory is the hard part. A container image that pins an old Node minor, a sidecar proxy that has not rolled, and a Python service that vendors brotli==1.1.0 can all be vulnerable while the host package looks fine. Ask each runtime and each image what Brotli version it embeds. Do not trust the application name. Trust the shared object or the release notes that name the bump.

What to install

Upgrade upstream Brotli to 1.0.10, 1.1.1, or 1.2.1, matching the line you are on. Move brotlicffi to 1.2.1.0 or later where you use the CFFI binding. Install the Node, Envoy, Istio, .NET, and distro packages your vendor has marked fixed. Rebuild self-contained binaries and container images after the library moves. A host patch does not rewrite an image that still carries 1.1.0 inside /node_modules or a static link.

New Zealand’s NCSC and other national notes have treated the issue as a decoder update across the ecosystem, not as a single product CVE. That framing is useful. Your ticket queue should list every place compression meets an untrusted stream: reverse proxies, API gateways, language runtimes that accept Content-Encoding: br, and offline tools that unpack archives. Shrink who can send you compressed bodies while you patch if you must. That is exposure control. It is not a substitute for the fixed decoder.

What this desk will not publish

Crafted stream layouts, decoder-state diagrams, and reproduction steps belong in the advisory chain, not here. Defenders need the version floors, the KEV date, and the reminder that Brotli is rarely installed under its own name on a dashboard. November 10 is the federal due date. The operational date is whenever the next untrusted br body hits a process that still ships 1.2.0.

This briefing relies on CISA’s Known Exploited Vulnerabilities catalog, Ubuntu’s CVE page, and public vendor and national advisories. It does not include exploit procedures or proof-of-concept detail.