The Brotli Fix Is Bigger Than a Node.js Update

CVE-2026-111497 is an out-of-bounds write in the Brotli C decoder. Google released corrected Brotli builds on 21 October. Node.js addressed the same flaw in its October security release, but that is only one place the decoder is used. Microsoft published a .NET advisory, and CERT-In now points administrators to updates for several integrations, including Envoy, Istio, Bun and Python packages.

That list is a map for investigation, not proof that every application using those products is reachable. The relevant path is the one that accepts a Brotli-compressed stream from an untrusted party and sends it to a vulnerable decoder. Deployment details and vendor guidance decide the actual exposure.

On 26 October, PHP replaced its Windows packages with 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. The -1 suffix identifies a package rebuild that includes Brotli 1.2.1; the PHP source releases and reported runtime versions are unchanged. A version check that only says “8.4.27” therefore cannot distinguish the original Windows package from the replacement.

PHP says its cURL extension can reach the affected decoder when automatic HTTP response decompression is enabled. cURL leaves that disabled by default, but application code or an HTTP client library may enable it. For teams assessing exposure, outbound fetches of attacker-influenced content deserve particular attention; the presence of cURL alone does not prove a reachable attack path.

1. 1

   Find every decoder copy. Include application runtimes, container images, proxies, libraries and bundled Windows packages. Record which supplier owns each update.

2. 2

   Test the data path. Identify where untrusted compressed responses or requests are accepted, and whether Brotli decompression is enabled in the deployed configuration.

3. 3

   Apply each vendor fix. Use the appropriate advisory for that product, rebuild or replace images, restart affected processes, and verify the running artifact—not only a version string from a different component.

Microsoft’s .NET advisory lists fixed releases for affected branches, but its package matrix is long; check the packages actually shipped in your application rather than copying a single universal version. No primary source reviewed here establishes active attacks against every affected integration. Keep a confirmed vulnerability, demonstrated exploitability in a particular setup, and observed intrusion as separate statements.

The PHP Windows rebuild was surfaced by The Cyber Security Hub newsletter, while CERT-In’s 27 October advisory drew attention to the wider dependency footprint. Threat Field Notes checked the PHP, Brotli and Microsoft advisories directly and combined the overlapping reports into one defender-focused update.