Brotli vulnerability and Cisco: What is actually confirmed

What triggers the new Brotli vulnerability

Node.js describes CVE-2026-111497 as a write beyond an internal decoder buffer. Malformed compressed input can corrupt the process, potentially causing a crash, memory disclosure or code execution. Processing attacker-controlled Brotli data is the essential prerequisite.

Brotli is used for HTTP compression under the br token, among other uses. A Brotli-compressed website alone does not establish a vulnerable Cisco appliance: identify the process and decoder that decompress the data. Forwarding or compressing it alone does not demonstrate this attack path.

What can be said about Cisco — and what remains unresolved

Across the public Cisco sources examined and targeted searches for Brotli and the CVE, we could not substantiate a product-specific PSIRT assessment for CVE-2026-111497 at our cutoff. The current PSIRT RSS feed retrieved also contained no matching entry. This research does not exhaust all Cisco products or non-public support information.

We therefore do not label IOS XE, NX-OS, ISE, Catalyst Center, Meraki or Secure Firewall as universally affected. Nor do we declare those families safe. Statements in a PHP advisory do not automatically apply to Brotli; the PHP2Shell article covers a separate set of flaws.

Two Cisco notices that are easily confused

CVE-2023-20215 concerns Cisco Secure Web Appliance filtering with content-encoding types including Brotli enabled. First published in 2023 and last updated in 2024, it describes a filtering bypass, not evidence for CVE-2026-111497. Cisco lists, for example, 14.5.3-033 and 15.2.0-164 as fixes in their respective branches. Those releases apply only to the older CVE.

Cisco document 225445, dated 2 February 2026, instead describes a limitation in Secure Web Gateway Brotli support during SSL inspection and resulting loading problems. It is not an advisory about the new decoder flaw. We therefore do not present its decryption exception as a mitigation for CVE-2026-111497.

Which updates outside Cisco are confirmed

The Brotli project published 1.2.1 as a security release. Node.js identifies security releases 22.23.4, 24.22.1 and 26.12.1. These are upstream or Node.js versions, not Cisco firmware recommendations. An appliance's embedded library must be replaced through the approved product update path.

What is known about exploitation

On 23 October, the Dutch NCSC reported no known evidence of active exploitation. Red Hat distinguishes potential code execution from evidence of a publicly available, reliable RCE exploit. These statements have a date and scope; they establish neither the absence of attacks today nor successful compromise of Cisco systems.

How operators can reach a defensible decision

1. 01

   Identify the product and runtime

   Record the exact product, release and deployment type. Assess your own Node.js services, containers and extensions separately from the Cisco appliance.

2. 02

   Establish the data path

   Determine whether the system decompresses untrusted Brotli input. Finding a library in the inventory warrants investigation; it does not fully establish exposure.

3. 03

   Obtain the vendor assessment

   If the public position is unclear, contact Cisco TAC or your maintenance provider with the product, version and CVE. Record the response and any bug ID; unresolved stays unresolved until evidence is available.

4. 04

   Deploy and verify the appropriate fix

   Test and deploy approved product or runtime updates. Then verify the actual running version and affected application function, including any required restarts or rebuilt containers.

A traceable assessment records the product, data path, vendor response and verification after updating. See our approach to network security and network project acceptance evidence.