EP. 189: CVE-2026-111497: Brotli Buffer Overflow Forces Emergency Patches Across Node.js and .NET

The Digital Warfare Podcast · Oct 26, 2026 · 5m · transcript

Summary

CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder that can corrupt process memory when vulnerable software decompresses specially crafted Brotli data. Depending on the affected application and memory layout, exploitation can lead to information disclosure, denial of service, privilege escalation, or arbitrary code execution.

Microsoft has now released out-of-band .NET updates, expanding remediation beyond the Node.js ecosystem. Node.js, Python packages, Bun, Envoy, Istio, and other software using vulnerable Brotli code have also received fixes or updates…