Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)

Immediate patching is the recommended course of action.

1. Update via Package Managers

Depending on your environment, execute the following:

# For Node.js environments
npm update brotli

# For Linux system libraries (e.g., Ubuntu/Debian)
sudo apt-get update && sudo apt-get install --only-upgrade libbrotli1

2. Source Build Environments

If you compile Brotli from source, checkout the latest secure tag (v1.2.1 or later) from the official GitHub repository and rebuild your binaries.

3. Temporary Mitigation

If patching is not immediately feasible, consider disabling Brotli decompression on your edge devices/WAF or fallback to Gzip encoding until updates are applied.

CVE-2026-111497 is a critical heap-based buffer overflow vulnerability residing in the Brotli decoder's core logic (c/dec/decode.c). The flaw stems from improper validation of return values and out-of-bounds writes (CWE-787, CWE-252) when processing malicious Brotli-compressed streams. An attacker can exploit this to overwrite adjacent memory structures, potentially gaining control over the instruction pointer. Given Brotli's widespread use in web traffic (Content-Encoding: br), this vulnerability poses a significant risk to internet infrastructure. The inclusion in CISA's KEV catalog and an EPSS score of 0.94 confirm active exploitation and high urgency.