Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

CISA adds exploited Google Brotli flaw to KEV catalogue

Part of the CVE-2026-111497 story · since 21 Oct

Developinglatest 2 hours ago14 articles7 outlets
21 Oct · SecurityOnline first25 Oct26 OctNowThis article14th of 14
  • Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds. Cites a CVE in CISA KEV.
  • Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV. This article, 14th of 14.

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalogue on 27 October 2026. The flaw affects Google Brotli, an open-source compression component that may be included in different products, and could let a remote unauthenticated attacker corrupt decoder memory, disclose sensitive information, cause a denial of service or potentially execute arbitrary code using a crafted Brotli-compressed stream.

The Google Brotli Unchecked Return Value Vulnerability is an unchecked return value flaw. Its stated attack vector is a crafted Brotli-compressed stream sent by a remote attacker who does not need to authenticate. The vulnerability has a CVSS score of 9.2, rated Critical. A patch is available; Google’s Brotli release information identifies version 1.2.1, and a Node.js advisory also addresses the issue. Organisations should check the relevant vendor guidance for products that incorporate Brotli.

KEV inclusion indicates that CISA has confirmed active exploitation. The available data lists use in ransomware campaigns as unknown. CISA set 10 November 2026 as the remediation deadline for affected Federal Civilian Executive Branch (FCEB) agencies.

CISA requires organisations to apply mitigations in accordance with vendor instructions and comply with its BOD 26-04 guidance on prioritising security updates and its Forensics Triage Requirements. Agencies should follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset’s internet exposure and follow the directive’s patching guidance. Although the deadline applies to FCEB agencies, all organisations should review their exposure, including products that use the Brotli component.

For full details, consult the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-111497) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).

How the story developed

All 14 articles
Developinglatest 2 hours ago14 articles7 outlets

14 articles from 7 outlets since 21 Oct. Still developing; the latest report was 2 hours ago. This was the 14th report, 6 days after the first.

Now21 Oct2324252627First reportSecurityOnline · 21 Oct, 17:54This article14th of 14 · day 6
  • Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds. Cites a CVE in CISA KEV.
  • Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV. This article, 14th of 14.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 14 articles as a list
  1. Wed 21 OctDay 01
    1. Node.js fixes Brotli flaw that could enable remote code execution17:54 · SecurityOnline · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 2 days

    Fri 23 OctDay 21
    1. Node.js Brotli flaw enables remote code execution in Linux arm64 builds08:35 · The Hacker News · Known exploited CVE
  3. Sat 24 OctDay 31
    1. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds11:00 · The Hacker News · Known exploited CVE
  4. Sun 25 OctDay 41
    1. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses08:30 · The Hacker News · Known exploited CVE
  5. Mon 26 OctDay 58
    1. Brotli flaw expands Node2Shell risk across HTTP applications01:30 · SecurityOnline · Known exploited CVE
    2. Microsoft issues out of band .NET fixes for four flaws03:19 · SecurityOnline · Known exploited CVE
    3. Brotli flaw triggers security updates across major software11:00 · SecurityWeek · Known exploited CVE
    Show 5 more from 26 Oct
    1. Brotli flaw exposes Python packages to remote code execution13:00 · SOCRadar · Known exploited CVE
    2. Microsoft patches critical .NET flaw that risks memory corruption13:30 · Infosecurity · Known exploited CVE
    3. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News · Known exploited CVE
    4. PHP releases rebuilt Windows packages to fix Brotli flaw18:30 · The Hacker News · Known exploited CVE
    5. Node.js Brotli flaw could expose memory or enable remote code execution19:00 · Rapid7 · Known exploited CVE
  6. Tue 27 OctDay 62
    1. Palo Alto confirms critical Brotli flaw affects PAN-OS02:00 · SecurityOnline · Known exploited CVE
    2. CISA adds exploited Google Brotli flaw to KEV catalogue20:01 · CISA · official · CISA alert · Known exploited CVE · This article, 14th of 14

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in