# Brotli decoder detection pack: CVE-2026-111497

Read-only checkers and hunting content for CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder (`c/dec/decode.c`). Security researchers and public research have nicknamed it HTTP2Shell, Node2Shell and Broccoli2Shell; those names come from public research, not from Google, and appear here only so you can match them to the CVE. Written 27 October 2026, checked against Google, NVD, cve.org, CISA (KEV feed), Node.js, Microsoft, Envoy, Bun, PyPI, PHP, Debian and Ubuntu sources between 19:00 and 19:30 GMT.

Brotli is a compression library. Anything that **decompresses** attacker-supplied Brotli data with a vulnerable decoder is exposed: web servers that accept `Content-Encoding: br` request bodies, HTTP clients that auto-decompress `br` responses, proxies with a Brotli decompressor, and code that parses `.br` files or streams. Compressing data is not the issue.

## Status at a glance (checked 27 Oct 2026)

| Item | Status | Source |
|---|---|---|
| Upstream fix | Brotli **1.0.10, 1.1.1 and 1.2.1**, released 21 Oct 2026: "CVE-2026-111497: out-of-bounds write permits remote code execution" | [Google Brotli releases](https://github.com/google/brotli/releases/tag/v1.2.1) |
| Affected upstream | 1.0.3 up to (not incl.) 1.0.10, 1.1.0 up to 1.1.1, 1.2.0 up to 1.2.1. Versions before 1.0.3 are not affected | [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-111497), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-111497) |
| CVE record | CNA **Google**, published 22 Oct 2026, title "Out-of-Bounds Write in Google Brotli Decoder", CWE-787 | [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-111497) |
| Severity | **CVSS 4.0 9.2 Critical from Google (the CNA)**, `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`. **NVD has not scored it** (`vulnStatus` Awaiting Analysis). Node.js rates it **High**; Microsoft scores it **CVSS 3.1 8.1** (`AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`) | NVD, Node.js blog, Microsoft advisory |
| CISA KEV | **Listed** 27 Oct 2026, `knownRansomwareCampaignUse` Unknown, `forensicTriage` **No**. CISA due date 10 Nov 2026 (applies to US federal agencies only, under BOD 26-04; patch now regardless) | [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) / [JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) |
| Exploitation | KEV listing is CISA's statement that the CVE is exploited. **No primary source publishes exploitation details, source IPs, payload hashes or other IOCs**, and none are included in this pack | KEV feed; Google, Node.js, Microsoft, NVD |
| CISA-ADP SSVC (23 Oct, before the KEV listing) | exploitation `none`, automatable `no`, technical impact `total` | NVD record (CISA-ADP container) |

### CISA KEV (verbatim fields from the feed)

Fetched from the [KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) on 27 Oct 2026 (feed `dateReleased` `2026-10-27T19:00:02.2307Z`, i.e. 19:00 GMT). Values are copied verbatim.

| Field | Value |
|---|---|
| `catalogVersion` | `2026.10.27` |
| `count` (catalog) | `1760` |
| `cveID` | `CVE-2026-111497` |
| `vendorProject` / `product` | `Google` / `Brotli` |
| `vulnerabilityName` | Google Brotli Unchecked Return Value Vulnerability |
| `dateAdded` | `2026-10-27` |
| `dueDate` | `2026-11-10` |
| `knownRansomwareCampaignUse` | `Unknown` |
| `forensicTriage` | `No` |
| `cwes` | CWE-252, CWE-787 |
| `shortDescription` | Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. |

The `dueDate` (10 Nov 2026) applies to US federal agencies only, under BOD 26-04. It is not a deadline for anyone else: **patch now regardless**.

`requiredAction`:

> Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

`notes`:

> This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111497

NVD lists only CWE-787 (from Google); the KEV entry adds CWE-252 (unchecked return value).

## Affected and fixed versions

Each row comes from that project's own advisory, release notes or package index. "Exposure" summarises when the project says the bug is reachable.

| Product | Affected | Fixed | Exposure / notes | Source |
|---|---|---|---|---|
| Google Brotli (C library) | 1.0.3 to 1.0.9, 1.1.0, 1.2.0 | **1.0.10, 1.1.1, 1.2.1** | Any decoder use | [Brotli releases](https://github.com/google/brotli/releases) |
| Node.js 22.x / 24.x / 26.x | Before the fixed release on each line | **22.23.4, 24.22.1, 26.12.1** | Rated High. Reachable through `node:zlib` Brotli decompression. Node.js says End-of-Life versions are always affected: **Node 20 and older (Node 20 EOL 30 Apr 2026) get no fix**. 24.22.0 is vulnerable | [Node.js October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) |
| Bun | Before 1.4.4 | **1.4.4** (22 Oct 2026) | The 1.4.4 notes list Brotli among the security fixes but **do not name the CVE** | [Bun v1.4.4](https://bun.com/blog/bun-v1.4.4) |
| Python `Brotli` (PyPI) | 1.0.3 up to 1.2.1 | **1.2.1** (22 Oct 2026). PyPI never received 1.0.10 or 1.1.1, so upgrade to 1.2.1 | Used automatically by urllib3, httpx and aiohttp when installed (from their source code) | [PyPI Brotli](https://pypi.org/project/Brotli/), [PYSEC-2026-4322](https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml) |
| Python `brotlicffi` (PyPI) | 1.0.3 up to 1.2.1.0 | **1.2.1.0** (22 Oct 2026) | As above | [PyPI brotlicffi](https://pypi.org/project/brotlicffi/), [PYSEC-2026-4323](https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml), [GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35) |
| .NET 8 / 9 / 10 (runtime) | Before the fixed runtime | **8.0.33, 9.0.22, 10.0.14** (SDKs 8.0.133 / 8.0.427, 9.0.123 / 9.0.320, 10.0.114 / 10.0.403) | CVSS 3.1 8.1 (MSRC severity Critical). **Not exposed by default**: only with ASP.NET Core `AddRequestDecompression` handling `br`, `HttpClient` `AutomaticDecompression` including Brotli or `All`, or direct `BrotliStream` / `BrotliDecoder` use. Self-contained apps must be **rebuilt**, NativeAOT apps **republished**. **.NET Framework is not affected** | [dotnet/announcements#494](https://github.com/dotnet/announcements/issues/494), [MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497) |
| .NET 11 previews | Previews, RC1, RC2 | **11.0.0-rc.3.26522.148** (SDK 11.0.100-rc.3.26522.148) | As above | Microsoft advisory |
| PowerShell 7.4 / 7.5 / 7.6 | Before the fix | **7.4.22, 7.5.13, 7.6.9** | MSRC severity Important | [MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497) |
| Visual Studio | 2019 16.11, 2022 17.14, 2026 18.11 / 18.12 | **16.11.61, 17.14.43, 18.11.2, 18.12 Insiders 3** | MSRC severity Critical | MSRC |
| Azure Linux 3.0 | `nodejs` 24.21.0-1, `brotli` 1.1.0-2 | **nodejs 24.22.1-1, brotli 1.2.1-1** | | MSRC |
| Envoy | Listed vulnerable: 1.39.2, 1.38.5, 1.37.7, 1.36.11 | **1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12** | Critical (CVSS 4.0 9.2). Only when a **Brotli decompressor** filter is configured | [GHSA-3wvj-j6qm-62mr](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr) |
| PHP for Windows | Original 8.2.35, 8.3.36, 8.4.27, 8.5.12 Windows builds and older | **Rebuilds 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1** (26 Oct 2026) with Brotli 1.2.1 | Reachable via the cURL extension when automatic response decompression is enabled. That is off by default in cURL, but applications and HTTP client libraries can enable it (Guzzle does by default: `decode_content` true sets `CURLOPT_ENCODING` to `''`). `-1` is a package rebuild: `php -v` still shows e.g. 8.4.27 | [PHP news 26 Oct 2026](https://www.php.net/archive/2026.php#2026-10-26-1), [Guzzle source](https://github.com/guzzle/guzzle) |
| curl for Windows (curl.se builds) | Builds with older Brotli | **8.23.0_5** (statically linked Brotli 1.2.1) | curl only decodes `br` with `--compressed` / `CURLOPT_ACCEPT_ENCODING`. No curl advisory exists; curl's exposure comes from the Brotli library it links. The `curl.exe` Windows ships in System32 is Microsoft's build: check its `curl -V` output | [curl for Windows](https://curl.se/windows/) |
| Go port `github.com/andybalholm/brotli` | Before v1.2.7 (inferred) | **v1.2.7** is referenced by Google's CVE record; the tag has no release notes | Pure-Go port, separate code base | [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-111497) |
| Debian | | **1.0.9-2+deb12u1** (bookworm, DLA-4855-1), **1.1.0-2+deb13u1** (trixie, DSA-6582-1), 1.2.0-4.1 (sid) | Debian's `nodejs` and `python-brotlicffi` link the system libbrotli, so updating `libbrotli1` fixes them (restart the processes) | [Debian tracker](https://security-tracker.debian.org/tracker/CVE-2026-111497) |
| Ubuntu | | **1.2.0-4ubuntu0.1** (26.10), **1.2.0-3ubuntu0.1** (26.04), **1.1.0-2ubuntu0.1** (24.04), **1.0.9-2ubuntu0.1** (22.04); 20.04 and older "needs evaluation" | Priority Medium. Ubuntu `nodejs` 22.04+ uses the system Brotli (not separately affected); 20.04 `nodejs` vendors it (vulnerable) | [Ubuntu CVE page](https://ubuntu.com/security/CVE-2026-111497) |

Frameworks that decompress Brotli without extra code (from their source, not from a vendor advisory): **Express 5** via body-parser 2.x (`br` request bodies are inflated by default), Node.js **fetch / undici** (`br` responses), **Guzzle** (PHP), and Python **urllib3 / httpx / aiohttp** when Brotli or brotlicffi is installed. Patch the runtime or library underneath; these frameworks have no separate fix.

## Corrections to claims we were given

| Claim | What the primary sources say |
|---|---|
| NVD scores it 9.2 | **NVD has not scored it** (Awaiting Analysis). 9.2 is Google's CNA score. Node.js says High; Microsoft says CVSS 3.1 8.1 |
| KEV due date is under BOD 22-01 | The KEV entry cites **BOD 26-04**. The due date applies to US federal agencies only |
| CISA requires forensic triage | `forensicTriage` is **No** for this CVE |
| ASP.NET Core / .NET apps are exposed by default | Microsoft: request decompression and `HttpClient` auto-decompression are **off by default**. .NET Framework is **not affected**; .NET 11 previews **are** |
| PHP's cURL decompresses Brotli by default | PHP: automatic decompression is **disabled by default in cURL**; applications and libraries (for example Guzzle) can enable it |
| Bun fixed CVE-2026-111497 in 1.4.4 | Bun's 1.4.4 notes list a Brotli security fix but do not name the CVE (partially verified) |
| Python Brotli 1.0.10 / 1.1.1 are available | PyPI has only **1.2.1** as a fixed release |
| Only Node.js, Bun, Python and .NET are affected | Also PowerShell 7.4-7.6, Visual Studio, Azure Linux, Envoy, PHP Windows builds, curl builds, distro `libbrotli` packages and the Go port |

## Not verified (no primary source)

- An exploitation attempt against Node.js 24.22.0 on 26 Oct 2026: only in secondary reporting.
- Claims of a public proof of concept, or that "crashes are easy, RCE only in limited setups": no vendor or CISA statement.
- Source IPs and payload hashes circulated in public research: **not published by Google, Node.js, Microsoft, CISA or NVD, so none are in this pack.**
- Express, fetch, requests/urllib3 and similar as exploitation routes: inferred from their source code; only Node.js (`node:zlib`) and Microsoft (.NET APIs) state their own exposure paths.
- That Bun 1.4.4's Brotli fix is this CVE, and what the Go port's v1.2.7 tag changes.
- Status of .NET 6/7 and PowerShell before 7.4: out of support and not listed by Microsoft (the checkers report UNKNOWN).

## How to check exposure

1. **Inventory**: run `scripts/check-brotli.sh` (Linux/macOS) or `scripts/Check-Brotli.ps1` (Windows, PowerShell 7) on each host, with `--search-dir` / `-SearchDir` pointed at application folders, virtualenvs and container image extracts. In Defender, run KQL Q1 (TVM by CVE) and Q2 (inventory).
2. **Reachability**: for each vulnerable component, ask whether untrusted Brotli data can reach it: internet-facing Node/Bun/Express APIs, ASP.NET Core with request decompression, Envoy with a Brotli decompressor, HTTP clients fetching untrusted URLs (webhooks, link previews, scrapers), PHP apps using Guzzle.
3. **Bundled copies**: Electron apps, container images, self-contained .NET apps, Python wheels and appliances carry their own Brotli. The checkers find common file names; vendor appliances need the vendor's advisory.

## Proactive steps

- **Patch** to the fixed versions above, then **restart every process** that had the old library loaded (Node, Bun, Python workers, IIS app pools, Envoy, PHP-FPM / php-cgi). Updating a shared `libbrotli` package does nothing for processes that are still running.
- **Rebuild** container images, self-contained and NativeAOT .NET apps, Electron apps and anything that vendors Brotli.
- **Move off end-of-life** Node.js (20 and older) and unsupported .NET.
- **Reduce exposure until patched**: reject `Content-Encoding: br` on inbound requests at the edge/WAF where your apps do not need it; disable ASP.NET Core Brotli request decompression; do not enable Brotli in `AutomaticDecompression` for clients fetching untrusted URLs; remove Envoy Brotli decompressor filters. These reduce exposure, they are not fixes.
- **Turn on the telemetry the hunts need**: Application event log collection (Event 1000/1026), Syslog `kern`/`daemon`, and proxy header logging if you want Q9-Q11.

## Reactive steps

1. Run Q3-Q8 over the whole period each host was vulnerable and exposed (not just since patching).
2. Treat a Brotli-decoding runtime spawning a shell (Q3) as a likely compromise: isolate the device in Defender, collect an investigation package, preserve process memory/core dumps if crashes were recorded.
3. Correlate crash loops (Q4-Q7) with inbound requests from the same window (Q9-Q11 if logged) and outbound connections (Q8).
4. Rotate secrets the process could read (environment variables, connection strings, API keys, cloud credentials), since the KEV description includes memory disclosure.
5. Rebuild compromised hosts or containers from clean images rather than cleaning in place.

## Patched does not mean clean

Patching stops new exploitation; it does not remove anything an attacker already did. Memory disclosure may already have leaked secrets, and code execution may have left persistence. On every host that ran a vulnerable decoder while exposed: hunt for runtime shell spawns, crash/restart loops, new outbound destinations and br-encoded requests from unfamiliar sources, and rotate secrets held by those processes.

## Files

| File | Purpose |
|---|---|
| `scripts/check-brotli.sh` | Linux/macOS read-only checker (bash) |
| `scripts/Check-Brotli.ps1` | Windows read-only checker (PowerShell 7; also runs on Linux/macOS), including the PHP for Windows rebuild check |
| `kql/brotli-hunting.kql` | 11 Defender XDR / Sentinel hunting queries |
| `sigma/*.yml` | 9 Sigma rules (process_creation, network_connection, Windows application log, Linux syslog, proxy, one event_count correlation) |
| `tests/run_tests.sh` | Test runner (bash checker, guard, read-only checks, shellcheck, PSScriptAnalyzer, Sigma, Pester) |
| `tests/Check-Brotli.Tests.ps1` | Pester tests for the PowerShell checker |
| `tests/fixtures/` | Mock runtime binaries (shell scripts printing canned version output), dist-info metadata, empty library files, CSVs and guard fixtures. Hashes in `go.sum` fixtures are placeholders (`PLACEHOLDER-NOT-A-REAL-HASH`) |

## Checker usage

Both checkers are **strictly read-only**: they read files, package metadata and file version resources, and run only known runtime binaries (node, bun, dotnet, curl, envoy, pwsh, python, and php on Windows) with a version flag (`-v`, `--version`, `--list-runtimes`, `-V`). They contain no exploit payloads, send no Brotli data, make no network connections and change no files or services.

```bash
sudo ./scripts/check-brotli.sh                                   # discover runtimes, libbrotli, Python packages
./scripts/check-brotli.sh --search-dir /srv/app --search-dir /opt # also look for bundled copies
./scripts/check-brotli.sh --bin /usr/local/bin/node               # one binary only
./scripts/check-brotli.sh --assess node=24.22.0 --assess brotli=1.1.0-2+deb13u1   # offline
./scripts/check-brotli.sh --csv inventory.csv                     # host,component,version
```

```powershell
pwsh -File .\scripts\Check-Brotli.ps1
pwsh -File .\scripts\Check-Brotli.ps1 -SearchDir 'D:\Apps','C:\inetpub'
pwsh -File .\scripts\Check-Brotli.ps1 -Assess 'php-windows=8.4.27-1,dotnet=8.0.32'
pwsh -File .\scripts\Check-Brotli.ps1 -CsvPath .\inventory.csv
```

`--assess` / `-Assess` components: `node bun brotli python-brotli brotlicffi dotnet pwsh envoy curl` (and `php-windows` in the PowerShell checker).

| Verdict | Exit code | Meaning |
|---|---|---|
| PATCHED | 0 | Fixed version, or NOT AFFECTED (below 1.0.3, or curl without Brotli) |
| LIKELY VULNERABLE | 1 | Version in an affected range with no evidence of a backport, or end-of-life with no fix |
| UNKNOWN | 2 | Version could not be determined, distro/vendor build whose backport status is unclear, or nothing found |
| error | 3 | Bad arguments, unreadable CSV, missing `--bin` / `--search-dir` |

The overall result is the worst verdict found. Every run ends with the KEV status line (with the federal-only due date) and the "patched does not mean clean" reminder.

Notes:
- **Execution guard.** A file is only run if its name is a known runtime name and it is a real ELF / Mach-O (Linux/macOS) or PE (Windows) binary. Scripts called `node`, npm/npx shims and anything else are reported as `SKIPPED (not executed)`. `BROTLI_TEST_ALLOW_SCRIPTS=1` exists only so the tests can use mock fixtures; never set it in production.
- **Distro packages.** On Debian/Ubuntu the bash checker compares `libbrotli1` with the fixed package versions (and checks the package changelog for the CVE). Distro-built Node.js and package-managed curl are reported UNKNOWN unless clearly fixed, because they may link the system library: patch `libbrotli` and restart.
- **PHP for Windows.** `php -v` cannot show the `-1` rebuild. The PowerShell checker uses the Brotli DLL version in the PHP folder if present, then a `-N` suffix in the install folder name (as in the official zip names, e.g. `php-8.4.27-1-nts-Win32-vs17-x64`), and otherwise reports UNKNOWN for 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Earlier versions are LIKELY VULNERABLE.
- **Self-contained .NET.** Found via `System.IO.Compression.Native` next to a `*.deps.json`; the runtime pack version in that file decides the verdict.

## Detection content notes

- **KQL has not been run against a live tenant.** The queries follow the documented Defender XDR / Sentinel schemas but have not been executed against real data. Columns marked `UNVERIFIED FIELD` depend on your connectors.
- **No IOCs.** No primary source has published any; everything is behavioural. Thresholds are heuristics.
- Q1-Q2: exposure (TVM). Q3: runtimes spawning shells/LOLBins. Q4-Q7: crash and restart loops (WerFault, Application log, Syslog, process start counts). Q8: rare public destinations. Q9-Q11: `Content-Encoding: br` requests, which **depend on proxy logging** of request headers; Q11 falls back to a POST-500 heuristic because W3CIISLog has no standard column for request headers.
- **Sigma** (sigma-cli 3.1.0, pySigma 1.5.1, pySigma-backend-kusto 1.0.1): all 9 rules pass `sigma check` with 0 errors, 0 condition errors and 0 issues. Conversion with `sigma convert -t kusto -p microsoft_xdr` works for the 5 process_creation and network_connection rules. **These 4 do not convert with the Kusto backend:** `brotli_linux_segfault_libbrotli` (syslog keywords, no table mapping), `brotli_windows_application_error` (application log, no table mapping), `brotli_proxy_request_content_encoding_br` (proxy category, no table mapping; its `cs-content-encoding` field is non-standard and labelled unverified) and `brotli_runtime_crash_burst_correlation` (correlation rules are not supported by the Kusto backend). Use KQL Q5, Q6 and Q9 instead, or a SIEM backend that supports them. With `-p azure_monitor` the two shell-spawn rules fail because SecurityEvent has no parent command line field; `-p sentinel_asim` converts all 5 convertible rules.

## Running the tests

```bash
bash tests/run_tests.sh
```

Needs shellcheck, pwsh with Pester 5+ and PSScriptAnalyzer, and sigma-cli with the Kusto backend (defaults under `~/tools`; override with `SHELLCHECK`, `PWSH`, `SIGMA`). The tests use only mock fixtures, prove the execution guard with a sentinel file, check the checkers write nothing and contain no network clients or Brotli handling, check every URL in the pack is a primary source, and run shellcheck, PSScriptAnalyzer, `sigma check` / `sigma convert` and the Pester suite.

## Limitations

- Version checks, not vulnerability tests: nothing here sends Brotli data to anything.
- Brotli embedded in statically linked binaries, appliances, browsers or closed-source apps is not detected unless a recognisable file name or metadata is present.
- Distro backports other than the Debian/Ubuntu versions listed are reported UNKNOWN.
- The KQL has not been run against a live tenant, and proxy-based queries need header logging most environments do not have.

## Sources

Primary sources only (vendor, project, government):

- Google Brotli releases: [v1.0.10](https://github.com/google/brotli/releases/tag/v1.0.10), [v1.1.1](https://github.com/google/brotli/releases/tag/v1.1.1), [v1.2.1](https://github.com/google/brotli/releases/tag/v1.2.1)
- CVE record: [cve.org CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497); [NVD CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497)
- CISA: [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), [BOD 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- Node.js: [October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- Microsoft: [.NET announcement #494](https://github.com/dotnet/announcements/issues/494), [MSRC CVE-2026-111497](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497)
- Envoy: [GHSA-3wvj-j6qm-62mr](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr)
- Bun: [Bun v1.4.4](https://bun.com/blog/bun-v1.4.4)
- Python: [PyPI Brotli](https://pypi.org/project/Brotli/), [PyPI brotlicffi](https://pypi.org/project/brotlicffi/), [GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35), PyPA advisory database PYSEC-2026-4322 / PYSEC-2026-4323
- PHP: [news, 26 Oct 2026](https://www.php.net/archive/2026.php#2026-10-26-1)
- curl: [curl for Windows](https://curl.se/windows/)
- Distributions: [Debian security tracker](https://security-tracker.debian.org/tracker/CVE-2026-111497), [Ubuntu CVE page](https://ubuntu.com/security/CVE-2026-111497)
- Source code consulted for default behaviour: [expressjs/body-parser](https://github.com/expressjs/body-parser), [nodejs/undici](https://github.com/nodejs/undici), [guzzle/guzzle](https://github.com/guzzle/guzzle)