Vulnerability Alert

CVE-2026-111497 Google Brotli Decoder Out-of-Bounds Write

Severity for Bravura Security Fabric: Low

CVE-2026-111497 Google Brotli Decoder Out-of-Bounds Write

Date: October 29, 2026
Products: Bravura Security Fabric 12.7, 12.8, 12.9 and 12.10

Bravura Security has been alerted to a vulnerability in the Brotli decompression code in Node.js, .NET and two Python packages. In our review, Bravura Security Fabric does not decompress Brotli data from users or networks. We will update the bundled Node.js and tighten the .NET runtime requirement in an upcoming release. We recommend you update the runtimes listed below.

Issue

On October 21, 2026, Node.js published fixes for CVE-2026-111497, a flaw in the Google Brotli decoder. Google published the CVE record on October 22. Microsoft published a .NET advisory on October 25.

A crafted compressed stream can make the Brotli decoder write past the end of its buffer. This can crash the process. In limited cases it can let an attacker run code. A program is exposed only if it decompresses Brotli data from an untrusted source.

Google rated the issue 9.2 (Critical) for the Brotli library itself. Microsoft rated the .NET issue 8.1 (High). These scores do not apply to Bravura Security Fabric.

Affected Versions

We reviewed the source code and installers for Bravura Security Fabric 12.7, 12.8, 12.9, and 12.10. Three runtimes are relevant:

  • Node.js. Fabric includes a Node.js 22 executable that runs only during skin and user interface builds. Releases 12.7 through 12.10 include Node.js 22.22.2, which is in the affected range. It does not run a server and does not decompress data from users or networks.
  • .NET. Our .NET services run on the .NET runtime you install on the server. Releases 12.7 and 12.8 do not use Brotli in .NET. Releases 12.9 and 12.10 use Brotli only to compress their own responses. They do not decompress Brotli data from requests or other servers, which is the condition for exposure.
  • Python. Python itself is not affected. The Python libraries we ship (urllib3 and requests) do not include the affected Brotli or brotlicffi packages.

The affected runtime versions are:

  • Node.js 22 earlier than 22.23.4, 24 earlier than 24.22.1, and 26 earlier than 26.12.1. Node.js 20, 23, and 25 are end of life and will not be fixed.
  • .NET 8 earlier than 8.0.33, 9 earlier than 9.0.22, and 10 earlier than 10.0.14. .NET Framework is not affected.
  • Python Brotli earlier than 1.2.1 and brotlicffi earlier than 1.2.1.0.

Remediations

Bravura Security recommends these updates:

  • .NET runtime. Update the .NET runtime on each Bravura Security Fabric server to 8.0.33 or later (10.0.14 or later on releases that use .NET 10). Then restart the Bravura Security Fabric services.
  • Node.js. We will update the bundled Node.js in an upcoming release. If you run your own Node.js programs, update them to 22.23.4, 24.22.1, or 26.12.1, or later.
  • Python packages. If you installed Brotli or brotlicffi in the Python used by Bravura Security Fabric, upgrade to Brotli 1.2.1 or later (brotlicffi 1.2.1.0 or later), or remove it.

Mitigations

Until you can update, use these temporary mitigations:

  • Run the skin and user interface build (make.bat) only on trusted input. Restrict access to the instance design folder to administrators.
  • Do not turn on request decompression or automatic Brotli decompression in any customization.

Questions

Please contact support@bravurasecurity.com if you have further questions on this topic.

References

  • CVE-2026-111497 (NVD)
  • Node.js October 2026 security releases
  • Microsoft Security Advisory CVE-2026-111497 (.NET)
  • GitHub advisory GHSA-9v8h-qqgm-4m35 (Python Brotli)