The Center for Internet Security warns that a vulnerability in the widely used Brotli compression library is being actively exploited and could let attackers seize control of vulnerable web servers.
A security flaw has been found in Brotli, a data-compression tool developed by Google that many websites use to shrink content before sending it over the internet, according to the Center for Internet Security. The flaw could let an attacker take over an affected computer system without needing a password or login.
The vulnerability, tracked as CVE-2026-111497, affects a range of widely used software that relies on Brotli, including multiple versions of Node.js, a popular tool for running web applications, as well as the Bun runtime, Envoy Proxy, Istio, Python’s Brotli package, Java’s brotli4j, and Microsoft .NET applications that use Brotli decompression. Older, unsupported versions of Node.js will not receive a fix.
According to the Center for Internet Security, the flaw occurs when a Brotli decoder mishandles an error during data processing, causing it to write information beyond its intended storage space. An attacker could exploit this by sending a specially crafted compressed file to a vulnerable system, potentially corrupting memory, exposing sensitive data, crashing the system, or running malicious code on it.
Initially there were no known real-world attacks, but the Center for Internet Security updated its advisory to note that working exploit code is now public and that exploitation attempts have been reported by outside researchers.
The risk is rated high for large and medium-sized government agencies and businesses, and medium for small organizations, since the flaw mainly threatens web servers and applications, not everyday home computers.
Organizations running the affected software should identify vulnerable systems and install the security updates released by Google, Node.js, Bun, and other affected vendors as soon as possible, the Center for Internet Security advises. Until patches can be applied, administrators can reduce risk by blocking Brotli-compressed data from untrusted sources.
Based on a release from Center for Internet Security.
