Brotli Flaw CVE-2026-111497 Added to CISA's Known Exploited Vulnerabilities Catalog: Where It Hides, Plant to Cloud

On 27 October 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497, a vulnerability in the Google Brotli compression library, to its Known Exploited Vulnerabilities (KEV) catalog. CISA adds a vulnerability to that catalog when it has evidence of active exploitation, which means attackers are already using it. Federal civilian agencies must fix it by 10 November 2026. CISA lists ransomware use as unknown.

Brotli is free, open-source software from Google that compresses and decompresses data, mostly to make web pages and files smaller so they move faster across a network. CVE-2026-111497 is a flaw in the Brotli decoder, the part that unpacks compressed data. The decoder does not properly check a result it gets back, which can lead to an out-of-bounds write, meaning the software writes data past the end of the memory set aside for it. According to CISA, a remote attacker who does not need to log in can send a specially crafted Brotli-compressed stream to corrupt the decoder's memory, expose sensitive memory contents, cause a denial of service, meaning the program crashes or stops working, or potentially run their own code. The National Vulnerability Database (NVD) lists a score of 9.2 out of 10 (Critical) from Google under version 4.0 of the Common Vulnerability Scoring System (CVSS).

What changed since our 21 October advisory: The Red Tiger team first wrote about this flaw on 21 October, when the Node.js project fixed it in its October security releases. At that time, no exploitation had been reported. CISA now has evidence that it is being exploited. CISA also notes that Brotli is an open-source component that many different products can use, so this is no longer only a Node.js update. It reaches any software that carries its own copy of the Brotli decoder.

Affected and fixed versions: According to NVD, Brotli versions 1.0.3 through 1.2.0 are affected on all platforms, and users should update to 1.0.10, 1.1.1 or 1.2.1. Google released Brotli 1.2.1 on 21 October 2026. Fixes have also reached software that bundles Brotli:

• Node.js 22.23.4, 24.22.1 and 26.12.1, released 21 October 2026.
• Microsoft .NET runtime 8.0.33, 9.0.22 and 10.0.14, per the Microsoft advisory posted 25 October 2026. Microsoft says ASP.NET Core and HttpClient do not decompress Brotli data in their default settings, so an application is exposed only when Brotli decompression has been turned on or is called directly. The older .NET Framework is not affected.
• The Python packages brotli 1.2.1 and brotlicffi 1.2.1.0, per GitHub advisory GHSA-9v8h-qqgm-4m35.
• The andybalholm brotli library for the Go programming language, version 1.2.7, released 23 October 2026.
• The Debian 12 brotli package, version 1.0.9-2+deb12u1, per Debian Long Term Support advisory DLA-4855-1 on 23 October 2026.

Where Brotli can hide, from the plant floor to the cloud: Almost nobody installs Brotli on purpose. It comes along inside other software, which is why it rarely shows up on an asset list. These are the places the Red Tiger team would check:

• Field devices and gateways. Industrial Internet of Things (IIoT) gateways, protocol converters and Node-RED flows that move plant data toward the historian or the cloud, many of them built on Node.js or Python.
• Embedded web servers and reverse proxies. The built-in web pages on devices, and the reverse proxies in front of web applications, which are servers that pass web traffic to the systems behind them and can handle compressed traffic.
• Control room. Web-based human-machine interfaces (HMIs), the screens operators use to watch and run the process, and historian front ends that serve plant data to a web browser.
• Engineering workstations. Web browsers, and engineering and configuration tools built on Electron, a framework that puts a web browser engine and Node.js inside a desktop application. These tools carry their own copy of the code and usually are not patched through Windows Update.
• Business network. In-house and vendor applications written in Python, .NET or Go that decompress web traffic or files.
• Cloud. Vendor remote monitoring portals, analytics platforms and other cloud services that exchange compressed data with your site.

What the Red Tiger team recommends:

1. Take inventory. Ask your original equipment manufacturers (OEMs), integrators and software vendors whether their products include Brotli, or Node.js, Electron, Python, .NET or Go components in the affected versions. Ask for a software bill of materials (SBOM), which is a list of the components inside a product, and check the ones you already have. Use passive, plant-safe methods on live operational technology (OT) systems.
2. Patch by exposure. Update internet-facing and cloud-connected systems first, then the buffer network between the business and control networks, then servers and workstations inside the plant. Test first and follow your normal change control process. Where a vendor has no fix yet, ask for a date.
3. Segment and restrict. Make sure HMI web servers, historian front ends and embedded web pages cannot be reached from the internet or the business network. Allow access only from the systems and people that need it, through a firewall and a virtual private network (VPN).
4. Monitor. Watch for crashes and unexpected restarts of web services, gateways and HMI applications, unusual outbound connections and new processes on these systems, and report anything unexpected to your vendor and your incident response team.

With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners find hidden components like Brotli inside vendor products with plant-safe methods, prioritize fixes by exposure, and lock down access from the plant floor to the cloud.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: CISA KEV alert, 27 October 2026: https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

NVD entry for CVE-2026-111497: https://nvd.nist.gov/vuln/detail/CVE-2026-111497

Google Brotli 1.2.1 release: https://github.com/google/brotli/releases/tag/v1.2.1

Microsoft .NET advisory: https://github.com/dotnet/announcements/issues/494

‍