The Vulnerability May Be Inside Software You Already Trust

On 9 November, Cisco updated its security advisory covering vulnerabilities in Node.js and the Brotli compression library. The revision changed the list of Cisco products under investigation, products with fixes available and products confirmed not vulnerable. Cisco also disclosed that proof-of-concept exploit code exists. Its Product Security Incident Response Team said it was not aware of malicious use of these vulnerabilities against Cisco products. [1]

The update concerns CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Brotli compresses web content such as HTML, CSS and JavaScript so it can move across networks using less bandwidth. The flaw appears when a vulnerable decoder processes specially crafted compressed data. Depending on the affected application and how it handles that input, the result can include memory corruption, a crash, disclosure of sensitive memory or potentially arbitrary code execution. [2][3]

The vulnerable upstream releases are Google Brotli 1.0.3 through 1.2.0. Fixed releases are 1.0.10, 1.1.1 and 1.2.1. Node.js also issued fixed releases for its supported 22.x, 24.x and 26.x lines on 21 October. [3][4]

CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 27 October. That is a signal of exploitation in the wild, although the public record does not identify the affected organisations or provide a detailed account of those attacks. Cisco's separate statement is narrower: it had no known malicious use against Cisco products at the time of its advisory update. For US federal civilian agencies covered by the relevant directive, the recorded remediation due date is 10 November. Other organisations should use vendor instructions and their own exposure and risk assessments to set remediation priority. [1][5]

The wider problem is dependency visibility. Brotli is embedded in more than one software stack. Canada's Cyber Centre lists technologies that include Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages. A company may never have installed Brotli as a standalone component; it may arrive inside a runtime, framework, container image or vendor product. [2]

That makes a simple package search an incomplete answer. Security and engineering teams need to know which applications process Brotli-compressed data from untrusted sources, which versions or vendor builds they use, and whether the fix has reached the running workload. An operating-system package update does not automatically prove that a separately bundled library inside an application or container has also been replaced.

A practical response should cover four steps:

• Build the dependency map. Use software bills of materials, package manifests, container inventories and vendor advisories to identify direct and bundled Brotli components.

• Prioritise exposed paths. Start with internet-facing applications and services that decompress untrusted input. Confirm the actual product version and vendor backport status rather than relying on a library name alone.

• Patch and rebuild. Apply the fixed release supplied by the relevant vendor. Rebuild and redeploy containers or applications that carry their own vulnerable copy.

• Verify the result. Check running versions, deployment records and external exposure. Monitor for unusual crashes, process behaviour and other signs of compromise.

Cisco's 9 November revision is a reminder that product impact assessments can change as vendors complete their reviews. A device that was previously listed as under investigation may later be confirmed affected, fixed or not vulnerable. Asset owners should track the advisory itself, not rely on an old ticket or a one-time scan. [1]

Authorised penetration testing can help validate the security of supported digital assets after teams have identified and patched vulnerable components. Bronyx AI, ITSEC's AI-assisted autonomous penetration testing platform, supports authorised assessment of web applications, APIs and defined network ranges. It can help teams examine exposed services and validate reachable weaknesses within an agreed scope. It does not replace software composition analysis, dependency inventory or vendor patch management. [6]

Find out more about Bronyx AI at https://bronyx.ai/.

References

1. Cisco, Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026, first published 27 October 2026, updated 9 November 2026. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u

2. Canadian Centre for Cyber Security, Alert - AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497, 28 October 2026. https://www.cyber.gc.ca/en/alerts-advisories/al26-027-critical-vulnerability-impacting-google-brotli-cve-2026-111497

3. National Institute of Standards and Technology (NIST), NVD - CVE-2026-111497 Detail, published 22 October 2026. https://nvd.nist.gov/vuln/detail/cve-2026-111497

4. Node.js Project, Wednesday, October 21, 2026 Security Releases, 21 October 2026. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

5. Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog: Google Brotli Unchecked Return Value Vulnerability, added 27 October 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

6. ITSEC Asia, ITSEC Asia Launches Bronyx AI, a World-Class Penetration Testing Platform, 16 July 2026. https://itsec.asia/blog/itsec-asia-launches-bronyx-ai-a-world-class-penetration-testing-platform