> ## Content Index
> Fetch the complete content index at: https://intelligence.zerodayengineering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# ⚡️ 0-Day Alert: Node.js, PyPI, .NET, and others
- URL: https://intelligence.zerodayengineering.com/0-day-alert-cve-2026-111497/
- Published: 2026-10-29T15:37:46.000Z
- Updated: 2026-10-29T15:37:46.000Z
- Description: The bug is now in active exploitation
- Author: Zero Day Engineering
- Tags: 0-Day Alerts

CVE-2026-111497: Google Brotli buffer overflow 

Logic error in input stream management of the 'br' decompression algorithm, leading to memory corruption and potential code execution. Impact is expressed through software that packages brotli library for input processing, such as Node.js and PyPI.

CWE-787 — Out-of-bounds Write (primary)

CWE-252 — Unchecked Return Value (secondary, contributing)

**The bug is now confirmed in active exploitation**. Stripe, Digital Ocean, and other digital infrastructure providers warned about it earlier. 

More software products are likely affected than currently reported. Furthermore, the issue may persist indefinitely in older software which bundles brotli library but fails to merge the fixed version. 

Current most dangerous attack vector - Node.js, where an exploit is remote and proven.

Brotli fixed versions: 1.0.10, 1.1.1, 1.2.1

Node.js: 22.23.4, 24.22.1, 26.12.1

![](https://intelligence.zerodayengineering.com/content/images/2026/10/Screenshot-2026-10-29-at-22.31.05.png)

![](https://intelligence.zerodayengineering.com/content/images/2026/10/Screenshot-2026-10-27-at-20.59.34.png)

![](https://intelligence.zerodayengineering.com/content/images/2026/10/Screenshot-2026-10-29-at-22.33.30.png)

![](https://intelligence.zerodayengineering.com/content/images/2026/10/Screenshot-2026-10-27-at-22.24.19.png)

![](https://intelligence.zerodayengineering.com/content/images/2026/10/Screenshot-2026-10-29-at-22.32.17.png)