Google Brotli flaw leaves 90% of cloud environments exposed, Wiz finds

A flaw in Google's Brotli compression technology has left 90% of the cloud exposed, according to Wiz, which found that 91% of cloud environments contain resources vulnerable to CVE-2026-111497. The issue began in Node.js but now affects Microsoft .NET, Mozilla Firefox and Thunderbird, and several Linux systems, while patches continue to roll out.

What Wiz found

Wiz found that 91% of cloud environments contain resources vulnerable to the flaw, and 82% have Node.js systems exposed directly to the internet. Netflix, PayPal, Walmart, LinkedIn, Uber, and NASA rely on Node.js for parts of their online services, so online stores, streaming services, banking apps, and company websites could be running on vulnerable infrastructure without realizing it.

Affected software and patch status

Patches are rolling out across Node.js, Bun, Microsoft's .NET platform, and Linux systems including Debian, Alpine, and Amazon Linux. Ubuntu and SUSE still do not have a fix available, while Red Hat has only partially patched the issue so far.

Red Hat confirmed that Mozilla Firefox and Thunderbird are among potentially affected applications, alongside Node.js and web servers processing Brotli-compressed traffic. Microsoft issued security updates for .NET, but said the older .NET Framework is unaffected and that ASP.NET Core and HttpClient do not use Brotli decompression by default.

Exploit risk

Public proof-of-concept code can trigger memory corruption and crashes, according to Red Hat, but no reliable public remote code execution exploit has been observed. Node.js patched 10 security vulnerabilities last week, including the serious Brotli decoder flaw, which OpenAI's security team reportedly found while testing its own systems and Node.js developers Matteo Collina and Antoine du Hamel fixed.

The bug can be exploited by tricking vulnerable software into decompressing malicious data. No login or credentials are needed if the software processes compressed data from an attacker, and the result can include exposed sensitive information, application crashes, or harmful code execution.

What organizations should do

Wiz warns that vulnerable components are widespread across Kubernetes clusters, cloud applications, API gateways, and containerized services. Companies should first patch internet-facing services handling untrusted Brotli data, then rebuild affected containers and check other software for bundled, outdated Brotli copies.

Where no fix is available yet, turning off Brotli decompression for untrusted data can reduce the risk.

Earlier coverage: Cloudflare adds emergency WAF rules for the Brotli CVE-2026-111497 flaw

Sources: Cybernews · The Register