Brotli CVE-2026-111497 affects Node.js, Envoy and web applications

Newly disclosed CVE-2026-111497 shows how a compression mechanism can become a remote attack surface. The buffer-overflow flaw is in the Brotli decoder and affects library versions 1.0.3 through 1.2.0. A crafted stream may corrupt adjacent decoder state, disclose memory, cause denial of service or potentially allow arbitrary code execution.

The issue is not limited to applications that explicitly install a package named Brotli. Vulnerable code may be embedded in a runtime, proxy, container image or standalone tool. Node.js rated the flaw High and released fixed versions 22.23.4, 24.22.1 and 26.12.1. Envoy identified its own affected and corrected releases. Microsoft has also documented protection for inbound traffic through Azure Web Application Firewall.

Breachroad’s conclusion: organisations must look beyond project dependency files to runtimes and packaged images. A WAF may reduce one attack path, but it cannot fix a process that downloads and decompresses data outside the gateway.

What is vulnerable

The CVE description locates the issue in the Google Brotli decoder at c/dec/decode.c across all platforms. An attacker needs no authentication when an application accepts Brotli-compressed data from an attacker-controlled source and passes it to the vulnerable decoder.

Upstream recommends moving to the appropriate fixed branch: 1.0.10, 1.1.1 or 1.2.1. The correct choice depends on the release line and how the library is delivered. For Node.js, the fixed 22.x, 24.x and 26.x versions are listed above.

Envoy confirms that 1.39.2, 1.38.5, 1.37.7 and 1.36.11 are vulnerable when the Brotli decompressor is configured. Fixed versions are 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. This is why asking only “do we use Brotli?” is insufficient—the component, data direction and active configuration all matter.

Where to look for exposure

Start with Node.js services, particularly those that accept compressed requests or fetch and decompress HTTP responses. Then assess:

• reverse proxies and service meshes built on Envoy;
• serverless functions and container images that bundle their own Node.js runtime;
• security tools, SBOM generators and scanners processing untrusted repositories;
• Python and other applications that embed their own library copy;
• installers and standalone binaries that do not use the operating-system package;
• services accepting request bodies with Content-Encoding: br;
• processes that fetch a URL supplied by a user, webhook or project content.

An application SBOM may miss a runtime embedded in an image. Combine the SBOM with image scanning, runtime version inspection and analysis of actual data flows.

What Azure WAF protects—and what it does not

Microsoft says Azure WAF with DRS 2.2 on Application Gateway or Azure Front Door Premium uses rule 920450 by default, covering Content-Encoding. In Prevention mode, a match receives a critical anomaly score and blocks the request Microsoft analysed.

For earlier rule sets, an overridden rule 920450 or Azure Front Door Standard, Microsoft provides a custom rule that blocks inbound requests whose Content-Encoding contains br. Before switching from logging to enforcement, teams should determine whether legitimate clients send Brotli-compressed request bodies.

The boundary is important: Azure WAF sees requests coming into the application. It does not protect a process that retrieves a Brotli response from the internet, a queue, a repository or another system. It also does not replace updating the library, runtime and image.

An action plan for organisations

1. Inventory runtimes and products

Collect Node.js versions from production, test, CI/CD, containers and serverless functions. Identify Envoy, ingress controllers, service meshes, scanning tools and standalone binaries that bundle a runtime. Do not restrict the review to actively developed repositories.

2. Confirm where decompression happens

Determine which components accept compressed request bodies and which fetch external content. Reachability and ownership are more useful for priority than the mere presence of a library file: an unreachable component presents a different risk from a public API.

3. Update the actual runtime source

When an application relies on a base image, changing package.json is not enough. Rebuild on a corrected version and verify the runtime inside the deployed artefact. For an appliance or managed service, obtain an impact statement and fixed release from the supplier.

4. Introduce temporary protection

Where patching takes time, restrict inbound Brotli request bodies at the edge if the application does not need them. Review logs first, then monitor client errors and bypass attempts after blocking. Treat the rule as a temporary barrier with an owner and removal date.

5. Assess outbound processing

Review webhooks, imports, repository scans, SBOM generation and integrations that download files. Restrict approved hosts and content types, and isolate untrusted processing. A WAF in front of the public API does not observe these paths.

6. Verify remediation with evidence

Record versions before and after the change, the image identifier, scan result and a functional test. The check must cover every replica and scheduled job, not only one pod.

Questions for suppliers

Ask whether the product contains Brotli directly, through Node.js, Envoy or another component. Request the exact corrected version, release date and whether images must be redeployed. If the supplier says the product is unaffected, ask why: no vulnerable version, a disabled decoder or no route from untrusted data.

“We have a WAF” is not a closure statement. Clarify the managed-rule version, Prevention mode, exceptions and whether the affected process makes outbound connections.

Source facts and Breachroad’s analysis

The CVE record and vendor advisories confirm affected Brotli versions, potential impact, corrected Node.js and Envoy releases, and the decoder-configuration condition. Microsoft describes default DRS 2.2 protection, a custom-rule option and the WAF’s inbound-only boundary.

Flow-based prioritisation, packaged-image review, supplier questions and evidence requirements are Breachroad recommendations. Add them to the vulnerability management process and software supply chain security programme. Teams can rehearse cross-functional response through cybersecurity training for organisations, while an IT security audit can establish real application exposure.

Primary sources: GitHub Advisory Database — CVE-2026-111497, Node.js — October 2026 Security Releases, Envoy — Out-of-Bounds Write in Brotli Decompressor, Microsoft — Azure WAF protection.