Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Active Exploitation of Critical Brotli Vulnerability Affecting Multiple Products

30 October 2026

Attackers are actively exploiting a critical Brotli vulnerability affecting multiple products to execute arbitrary code remotely or disclose sensitive information on affected systems. Patch immediately.

Background

Security updates have been released to address a critical vulnerability (CVE-2026-111497) in the Brotli decoder. Brotli is a popular lossless compression algorithm developed by Google and is used in multiple products such as Node.js and Microsoft .NET. The vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 9.8 out of 10. 

Impact

Successful exploitation of this out-of-bounds write vulnerability could allow an attacker to execute arbitrary code remotely or disclose sensitive information from the memory of affected systems. Exploitation requires an affected application to decompress attacker-controlled Brotli-compressed data.

Known Exploitation

A Proof-of-Concept (PoC) is publicly available and this vulnerability is reportedly being actively exploited.

Affected Products

The vulnerability affects the following versions (non-exhaustive):

  • Node.js 22.x versions prior to 22.23.4

  • Node.js 24.x versions prior to 24.22.1

  • Node.js 26.x versions prior to 26.12.1

  • Microsoft .NET 8

  • Microsoft .NET 9

  • Microsoft .NET 10

  • Microsoft .NET 11 

Recommendations

Users and administrators of affected products are advised to update to the latest security versions immediately.

References

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases (opens in new tab)

https://vercel.com/kb/bulletin/node-js-security-advisory (opens in new tab)

https://www.tenable.com/cve/CVE-2026-111497 (opens in new tab)

https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/ (opens in new tab)