A flaw in Google's reference C decoder for Brotli, the compression format many websites use, lets crafted compressed data write past the end of a buffer, which can crash a program, leak memory or, in some setups, run code. Node.js disclosed it on October 21 with credit to OpenAI's Codex Security researchers; the fix was in Brotli's source in February, but nobody knew then it was a security bug, The Register reports.

This week the fallout spread. Microsoft shipped out-of-band .NET updates on October 25, and Palo Alto Networks rolled out hotfixes for PAN-OS firewalls that inspect Brotli traffic. According to the Broccoli2Shell site, threat-intelligence firm ELLIO saw exploit traffic using the public proof of concept on October 26, and CISA added CVE-2026-111497 to its exploited-vulnerabilities catalog on October 27.

Anything that decompresses Brotli data from others with Brotli 1.0.3 to 1.2.0 can be exposed, including Node's built-in fetch and Python's requests when a Brotli package is installed. Patched programs must also be restarted, and container images rebuilt.