October 27, 2026 at 8:55 PM EDT
Brotli bug now exploited in the wild; new undici and pymongo fixes
criticalkevhigh
CISA added the critical Brotli flaw CVE-2026-111497 to its exploited list with a November 10 deadline. undici also shipped fixes for four high-severity bugs, and pymongo fixed a buffer over-read.
Google Brotli: CVE-2026-111497
- What: CVE-2026-111497, a memory-safety flaw in Google's Brotli library that is bundled in Node.js and shipped in Linux distributions.
- Severity: Critical (9.2).
- Exploited: Yes. Added to CISA's Known Exploited Vulnerabilities catalog on October 27, with a November 10 remediation deadline.
- Fixed in:
- Node.js 22.23.4, 24.22.1 and 26.12.1.
- Amazon Linux 2023 via ALAS2023-2026-3334.
- PyPI
brotli1.2.1.
- Note: Debian 11 still has no fixed package.
undici: four high-severity fixes
None are known to be exploited. The first three are fixed in 6.29.1, 7.30.1 and 8.12.2:
- CVE-2026-109383 (7.4): TLS certificate checks can be skipped.
- CVE-2026-109829 (7.4): cross-site cache poisoning.
- CVE-2026-87018 (7.5): process crash.
- CVE-2026-109855 (7.5): affects only 8.11.x and is fixed in 8.11.2.
Check Node.js and Next.js lockfiles for undici.
pymongo: CVE-2026-106435
- What: CVE-2026-106435. Decoding malformed data can make MongoDB's Python driver read past the end of a memory buffer.
- Severity: High.
- Exploited: Not known to be exploited.
- Fixed in: 4.18.3.
Also noted
- CISA's other Known Exploited Vulnerabilities addition that day was for Magento.
General information only. Confirm fixed versions in the linked official advisories before patching.