Brotli Zero-Day CVE-2026-111497: What Website Owners Must Do Now


Brotli zero-day CVE-2026-111497 affecting websites and servers, with update steps

Most website owners have never heard of Brotli, yet their sites almost certainly rely on it every day. Google built the library to compress data so pages load faster, and it now sits quietly inside a long list of software that keeps the web running. A new flaw, CVE-2026-111497, has turned that quiet dependency into a real problem, because attackers are already exploiting it.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, and gave federal agencies until November 10, 2026 to deal with it. That deadline is only binding on those agencies, but it is a useful clock for everyone else who runs a server or a website: the window is short, and patching can no longer wait for the next maintenance day.

What exactly is the Brotli flaw?

The bug is an out-of-bounds write in Brotli's decoder, the part of the library that takes compressed data and turns it back into its original form. According to Tenable's explainer, an attacker can send carefully crafted compressed data, and if an application decompresses it, memory gets corrupted in a way that may lead to remote code execution on the server.

Google rated the issue 9.2 out of 10 on CVSS version 4.0, which puts it firmly in critical territory. Security write-ups have given it several nicknames, including HTTP2Shell, Node2Shell and Brotli2Shell, but they all describe the same flaw.

Brotli versions 1.0.3 through 1.2.0 are affected. Google shipped fixes for three release lines on the same day: 1.0.10, 1.1.1 and 1.2.1.

Why this matters for sites in the Arab world

The real exposure is not Brotli on its own but the software that bundles a private copy of it. Help Net Security described the bug as reaching "far beyond Node.js", and the affected list compiled by Tenable and the Canadian Centre for Cyber Security includes:

  • Node.js, which powers a large share of online stores, dashboards and APIs across the region.
  • Bun, the newer JavaScript runtime.
  • Envoy Proxy and Istio, common in cloud and Kubernetes setups.
  • Microsoft .NET and PowerShell.
  • Python compression packages such as Brotli and brotlicffi on PyPI.
  • PHP for Windows builds.

If you run a Node.js store, an app behind a cloud gateway, or an internal tool that accepts compressed uploads, you are in scope. Even a simple WordPress site on shared hosting sits on a server that may include affected components, so it is worth confirming that your host has patched.

Is it really being exploited?

Yes. A KEV listing means CISA has evidence of real-world attacks, and Help Net Security reported that Node2Shell is under active attack. Tenable, for its part, said it had not independently confirmed one of the reported exploitation attempts. That kind of mismatch is normal in the first days after disclosure, and it does not change the practical takeaway: patch now rather than wait for a fuller picture.

The fixed versions you need to know

  • Brotli library: 1.0.10, 1.1.1 or 1.2.1, depending on your branch.
  • Node.js: 22.23.4, 24.22.1 and 26.12.1, released on October 21, 2026. The 25.x, 23.x and 20.x lines and older are end of life and will not receive a fix, so the answer there is to move to a supported line.
  • Python: the Brotli package 1.2.1 and brotlicffi 1.2.1.0.
  • Istio: 1.29.9 includes the fix, although the 1.29 line reached end of life on October 15, 2026, so plan a move to a newer branch.
  • Debian: 1.0.9-2+deb12u1 for bookworm and 1.1.0-2+deb13u1 for trixie, according to the Debian security tracker.

For Envoy, PHP for Windows and .NET, check each project's official security advisory for the exact patched release before you upgrade.

A practical checklist for site owners and server admins

  1. Inventory what runs on your server. Note your Node.js version, your PHP version, and whether the site sits behind Envoy, Istio or a Docker container.
  2. Patch Node.js first. Run node -v; if you are below the versions listed above, upgrade straight away. Updating the npm package called "brotli" does not help, because the vulnerable code is compiled into the Node.js runtime itself, a point several reports stressed.
  3. Update system packages. On Debian, run your usual package upgrade and confirm the brotli package reached the fixed version. On Ubuntu, watch the official security notices, since some reports said the package was still listed as under evaluation there.
  4. Rebuild your containers. Old Docker images carry their own copies of libraries. Rebuild them on updated base images and redeploy.
  5. Check your Python apps. Run pip show brotli brotlicffi inside every virtual environment and upgrade where needed.
  6. On shared hosting, you usually cannot touch server components yourself. Send your host a short message asking one direct question: have you patched CVE-2026-111497? A serious provider will give you a clear answer.
  7. Update browsers across your team. Modern browsers decompress Brotli constantly, and keeping them current is the cheapest protection you have. Check your browser's release notes for the version that carries the fix.
  8. Watch your logs. Unexplained crashes of Node.js processes or backend services over the past few days deserve a closer look, especially if they line up with odd requests carrying compressed payloads.

What about Nginx, Apache and CDNs?

Most websites use Brotli to compress pages on the way out to visitors, while this flaw lives in the decompression side. That means the biggest risk sits with services that accept compressed data from outside and unpack it, such as reverse proxies and runtimes that process incoming requests. It is still not a reason to ignore Nginx or Apache: their Brotli modules depend on the same library, so moving to builds linked against a fixed version is the safe call.

If you sit behind a CDN, the provider is responsible for its own edge servers, but your origin server behind it is still yours to patch.

Frequently Asked Questions

Is my WordPress site at risk?

WordPress itself is not directly affected, but the server underneath it may run affected components. Ask your host, or update the server packages if you manage the machine yourself.

Is updating the brotli npm package enough?

No. The vulnerable copy is built into Node.js, so you need to upgrade Node.js to one of the fixed releases.

What does the November 10 deadline mean?

It is the date CISA set for U.S. federal agencies to remediate the flaw, and it works as a sensible target for everyone else.

Should I switch off Brotli compression?

In most cases, no. Patching is the fix. Disabling compression slows your site down without repairing the affected components.

Sources

Because technology is now part of every detail of our day, our interest extends from following Arabic websites and specialized tech blogs to what stores in Egypt, stores in Kuwait, vitamin stores and international websites offer, while relying on Mashhor for social media services as a key factor for success and continuity.

 

And that is it, dear friends — mission accomplished ✌

Send your blessings upon the beloved Prophet, and do good however small 🎯🌷

And do not forget our brothers and sisters everywhere in your prayers📌

Best regards from the #Raqmiyoun team

You can also browse our store products here 👈#OurStore 🌷or here

 

To join our family on the Telegram group 👈click here

And our Facebook group, where we share information and help members 👈here

To follow our news on Google News, click here✌👇

Raqmiyoun on Google newsGoogle News

 

You may also like :

5 technical tips to protect your business

Google penalizes annoying websites

A security test reveals an unexpected breach by a Meta model

Cisco Firewall Zero-Day CVE-2026-76418 Is Being Exploited: What to Do Now

Phishing With Real Booking Data and Booby-Trapped Calendar Invites: How to Stay Safe