Brotli fixes have to reach the decoder that runs

Follow the native decoder into the running workload#

Google's Brotli maintainers released fixes for CVE-2026-111497 on 21 October 2026. The Node.js security release describes an invalid block-switch condition that could be reported as a request for more input rather than a permanent format error. Continued streaming input could then write beyond an internal buffer. The project identifies crashes, memory disclosure and possible code execution when an application decompresses attacker-supplied data.

The upstream library release is only one delivery point. Runtimes can bundle the decoder, applications can include another native copy, and managed platforms have their own rollout and deployment requirements. A useful remediation record has to identify which copy processes the untrusted bytes.

Three ownership layers#

The library. Establish whether the application links a distribution-maintained decoder, vendors the source or embeds a prebuilt component. An operating-system package update cannot prove that a statically bundled copy changed.

The runtime or application. Use the relevant vendor's release record. The Node.js advisory covers its bundled decoder and supported release lines; that statement does not automatically resolve the status of a different runtime or an application's extra dependencies.

The deployment. A newly available base image or managed runtime update is not proof that an existing workload uses it. Record the deployed image digest or provider-specific runtime state, and follow the provider's documented rebuild or redeployment procedure.

AWS's 28 October bulletin illustrates the distinction. It separates the Lambda managed service from affected runtime components and distinguishes container base-image updates from ZIP-runtime rollout. It also discusses application-supplied libraries and layers. Provider-managed infrastructure does not remove responsibility for the code an application packages itself.

Initial fixes, with the evidence kept attached#

These are the first published fix boundaries, not a claim that they are the newest suitable releases. AWS's bulletin notes a regression affecting its Node.js 24 rollout and describes a targeted update approach. A provider's backported fix should therefore be assessed through that provider's evidence rather than rejected solely for not matching an upstream version string.

Find the input path before choosing a temporary control#

Brotli is used to decode content, so the relevant boundary is untrusted compressed data reaching the affected implementation. Incoming request bodies and content fetched from external services are different paths. A rule at an inbound reverse proxy cannot independently cover a process decoding an outbound HTTP response.

Map the actual path using application configuration and supported runtime documentation. Identify APIs, workers, crawlers and other services that process content from outside their trust boundary. Include background jobs and stored data that may be decoded later.

Where an immediate update is unavailable, use vendor-backed mitigations for the specific product. Avoid presenting one instruction to reject a compression header as a universal fix. The control must be applied before the vulnerable decoder is invoked and must cover the relevant input route.

Safe inventory checks#

Read the runtime version inside the actual container or environment, not only on the host. Inspect resolved Python packages in each application environment where applicable. For distribution packages, compare the full package release with the distribution tracker, including security backports.

For a Node.js process environment that the operator controls, this expression prints the runtime and bundled Brotli version reported by that runtime:

node -p 'JSON.stringify({node: process.versions.node, brotli: process.versions.brotli}, null, 2)'

It does not test exploitability or inspect a different running service. Execute it in the intended workload environment and retain the deployed image or release identity alongside the output. A provider can backport a correction, so interpret the reported values using the relevant runtime or provider bulletin.

For an existing Python environment, package metadata can be read without installing or updating dependencies:

python -m pip show Brotli brotlicffi

An absent package result does not prove that the application lacks every native decoder. A vendored extension, another environment or a separate process can still require review. Likewise, pip metadata does not establish which binary was loaded by an already running worker.

After rebuilding, verify that the intended workload received the new artefact and that old worker groups or recovery templates cannot quietly restore the affected copy. Use ordinary valid compressed data for deployment smoke tests; malformed exploit input is unnecessary for this inventory and rollout check.

For vendored code, connect the source revision to the built artefact and deployed workload. A source-tree match is a useful lead; it cannot show which binary a running process loaded. No malformed compressed stream is needed for this inventory work.

The libwebp response provides a close operational comparison: a widely reused native decoder can outlive the most visible product update in less obvious application copies. The Log4Shell case adds the need to reconcile build, deployment and runtime evidence.

The current task is to close those specific decoder paths with verifiable software and deployment changes. Public advisories establish affected ranges and fixes; they do not, on their own, establish exploitation in a particular environment. Keep any claim about active attacks attached to direct evidence from the reporting party.