Brotli vulnerability and Cisco: What is actually confirmed

What triggers the new Brotli vulnerability

Node.js describes CVE-2026-111497 as a write beyond an internal decoder buffer. Malformed compressed input can corrupt the process, potentially causing a crash, memory disclosure or code execution. Processing attacker-controlled Brotli data is the essential prerequisite.

Brotli is used for HTTP compression under the br token, among other uses. A Brotli-compressed website alone does not establish a vulnerable Cisco appliance: identify the process and decoder that decompress the data. Forwarding or compressing it alone does not demonstrate this attack path.

What can be said about Cisco — and what remains unresolved

A direct search of Cisco's public advisory catalogue returned no result for CVE-2026-111497 during this recheck. Searching for Brotli returned only the older CVE-2023-20215 advisory. The current PSIRT RSS feed also contained no matching new entry. A product-specific Cisco assessment therefore remains unsubstantiated; this catalogue result does not exhaust all products or non-public support information.

We therefore do not label IOS XE, NX-OS, ISE, Catalyst Center, Meraki or Secure Firewall as universally affected. Nor do we declare those families safe. Statements in a PHP advisory do not automatically apply to Brotli; the PHP2Shell article covers a separate set of flaws.

Two Cisco notices that are easily confused

CVE-2023-20215 concerns Cisco Secure Web Appliance filtering with content-encoding types including Brotli enabled. First published in 2023 and last updated in 2024, it describes a filtering bypass, not evidence for CVE-2026-111497. Cisco lists, for example, 14.5.3-033 and 15.2.0-164 as fixes in their respective branches. Those releases apply only to the older CVE.

Cisco document 225445, dated 2 February 2026, instead describes a limitation in Secure Web Gateway Brotli support during SSL inspection and resulting loading problems. It is not an advisory about the new decoder flaw. We therefore do not present its decryption exception as a mitigation for CVE-2026-111497.

Which updates outside Cisco are confirmed

The Brotli project published 1.2.1 as a security release. Node.js identifies security releases 22.23.4, 24.22.1 and 26.12.1. These are upstream or Node.js versions, not Cisco firmware recommendations. An appliance's embedded library must be replaced through the approved product update path.

What is known about exploitation

Laboratory code execution is demonstrated: on 22 October, Imperva reported successful tests using the official Node.js 24.22.0 Linux arm64 image without an instrumented binary. Execution required multiple attempts; Node.js 24.22.1 rejected the same inputs. This establishes that test setup, not successful compromise of Cisco products or an actual attack campaign.

On 23 October, the Dutch NCSC reported no known evidence of active exploitation. When retrieved again on 26 October, CISA catalogue version 2026.10.23 contained no entry for this CVE. Absence from KEV does not prove a worldwide absence of attacks. Red Hat's assessment of a publicly available, reliable RCE exploit must also be distinguished from Imperva's laboratory result and observed real-world attacks.

How operators can reach a defensible decision

1. 01

   Identify the product and runtime

   Record the exact product, release and deployment type. Assess your own Node.js services, containers and extensions separately from the Cisco appliance.

2. 02

   Establish the data path

   Determine whether the system decompresses untrusted Brotli input. Finding a library in the inventory warrants investigation; it does not fully establish exposure.

3. 03

   Obtain the vendor assessment

   If the public position is unclear, contact Cisco TAC or your maintenance provider with the product, version and CVE. Record the response and any bug ID; unresolved stays unresolved until evidence is available.

4. 04

   Deploy and verify the appropriate fix

   Test and deploy approved product or runtime updates. Then verify the actual running version and affected application function, including any required restarts or rebuilt containers.

A traceable assessment records the product, data path, vendor response and verification after updating. See our approach to network security and network project acceptance evidence.