CVE-2026-111497

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.

This issue is rated Important. Exploitation requires that the target decompress attacker-controlled Brotli data (for example HTTP content negotiated with Content-Encoding: br, or APIs such as Node.js zlib / fetch() that decode Brotli). The vulnerable path is reached with a malformed stream rather than typical well-formed encoder output. Red Hat Enterprise Linux compiler and runtime hardenings - including Address Space Layout Randomization (ASLR), Non-eXecutable (NX) memory, FORTIFY_SOURCE, and SELinux - increase the difficulty of turning this memory corruption into reliable code execution, though they do not eliminate crashes or all impact. Combined with the Attack Requirements noted by the CNA (CVSS v4 AT:P), Red Hat scores Attack Complexity as High and rates the flaw Important rather than Critical.

The Node.js packages in Red Hat Enterprise Linux use either system version of brotli or bundled version. Some Node.js versions are marked "Not affected" because they utilize system brotli. For these versions, the Node.js package itself does not require updating. However, customers must still update the system brotli/libbrotli package to address the vulnerability for these Node.js installations.

Following is the overview of Node.js versions use system or bundled version.

• Node.js 22 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:22 module, uses system brotli.
• Node.js 24 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:24 modules, use bundled brotli.
• Node.js 22 and 24 in Red Hat Enterprise Linux 10, provided via nodejs22 and nodejs24 use system brotli.

The .NET packages in Red Hat Enterprise Linux may either use system version of brotli or bundled version. Following is the overview of .NET versions use system or bundled version.

• .NET 8.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet8.0 packages, use bundled brotli.
• .NET 9.0, 10.0, and 11.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet9.0, dotnet10.0, and dotnet11.0 packages, use system brotli.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

See the security bulletin for a detailed mitigation procedure.