Brotli had no confirmed attacks on Monday. On Tuesday CISA listed it as exploited.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Tuesday 27 October CISA added CVE-2026-111497, the Brotli decoder flaw, and CVE-2026-48356, a dangerous file upload flaw in Adobe Commerce and Magento, to its exploited list. CISA cites evidence of active exploitation. On 26 October BleepingComputer had reported only published proof-of-concept exploits for Brotli.
Why it matters
Brotli is built into Node.js and used by Python HTTP clients, so a crafted compressed response can reach your code. Now someone is using that door. A stale container image keeps it open.
What to do
Update Node.js to 22.23.4, 24.22.1 or 26.12.1 and Python Brotli to 1.2.1, then restart processes and rebuild images. If you run Adobe Commerce or Magento, apply Adobe's mitigations for CVE-2026-48356 today.
My take
Lior Aharonov
Founder, 7IT Solutions
A public exploit and a listed exploit are one step apart. Restart your processes, not just your packages.
Sources
| CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (27 October 2026) | cisa.gov |
| BleepingComputer: Critical HTTP2Shell Brotli vulnerability triggers emergency patches | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.