Conversation

For some reason, the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is a far wider issue. Brotli compression is supported by many client-side applications processing HTTP responses. While some of them have sandboxes and a quick update cycle (read: web browsers), many don't. In particular, many devices and applications using #curl / libcurl are affected and must be updated ASAP.

https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://nvd.nist.gov/vuln/detail/cve-2026-111497

#infosec #cybersecurity #CVE_2026_111497

In case of curl the silver lining is that by default curl / libcurl doesn't decompress the data. curl command only decompresses if requested with --compressed option and libcurl CURLOPT_ACCEPT_ENCODING defaults to NULL.

If running #apache2 you probably want to update brotli as soon as possible or if not possible a2dismod brotli and restart apache2.

For #nginx you probably want to update brotli as soon as possible, too, and or if not possible disable it for now if enabled (brotli off;) and reload nginx.