Brotli CVE-2026-111497: Is Your PHP Server Affected? Fixes by Distro

CVE-2026-111497 is a critical bug in Brotli, the compression library behind the br content encoding used by browsers, web servers, Node.js and many PHP setups. It is an out-of-bounds write in the Brotli decoder: a crafted Brotli stream can make the library write past the end of an internal buffer while it decompresses. Google released fixed Brotli versions on 21 October 2026, the CVE was published on 22 October with a CVSS v4 score of 9.2 (critical), and PHP followed on 26 October with rebuilt Windows packages. If you run PHP on Linux, the fix does not come from PHP at all. It comes from your distribution's Brotli package, or from whoever built the copy of Brotli that your PHP actually loads.

What Happened and When

• 21 October 2026 - Brotli 1.2.1 is released with CVE-2026-111497 listed as an out-of-bounds write that permits remote code execution. Brotli 1.1.1 and 1.0.10 carry the same fix for the older release lines. Node.js publishes security releases the same day.
• 22 October 2026 - The CVE record is published: Brotli 1.0.3 through 1.2.0 are affected on all platforms, scored CVSS v4.0 9.2 (critical).
• 26 October 2026 - PHP publishes rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) that include Brotli 1.2.1. AlmaLinux publishes fixed brotli packages for AlmaLinux 8, 9 and 10 the same day.

Debian and Ubuntu also list fixed Brotli packages for their current releases; the versions are in the table further down.

What the Bug Is, in Plain Terms

Brotli decompresses data as a stream: it reads compressed input piece by piece and keeps a small amount of state between pieces. According to the Node.js advisory, an invalid block switch in malformed input was reported as a temporary need for more input instead of a permanent format error. The streaming decoder then kept appending input bytes to an eight-byte internal buffer, and past its end. Depending on what sits next to that buffer, the result is a crash, a leak of process memory, or in the worst case code execution inside the program that was decompressing the data.

Two details matter when you judge your own risk:

• Only decompression is affected. The vulnerable code is in the decoder (c/dec/decode.c). Compressing data with Brotli uses the encoder.
• An attacker has to get Brotli data decompressed by your software. In practice that means your server downloads something from a server the attacker controls (an API, a webhook target, a feed, a remote image or font) with automatic decompression turned on, or accepts Brotli-compressed input from users. The CVSS vector reflects this as "attack requirements present". In CISA's assessment dated 23 October, no exploitation was recorded.

Does It Affect PHP?

PHP itself contains no Brotli code. The php.net notice of 26 October is about the Windows builds, which ship third-party libraries, Brotli among them. In those builds the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. It is off by default in cURL, but applications and HTTP client libraries can switch it on: setting CURLOPT_ENCODING (also called CURLOPT_ACCEPT_ENCODING) to an empty string tells cURL to accept and decode every encoding it supports, including Brotli when libcurl was built with it. The -1 suffix on the Windows packages means a rebuild with updated libraries; the PHP version itself does not change.

On Linux, PHP does not bring its own Brotli in the usual case. The cURL extension uses libcurl, and libcurl uses whatever Brotli library it was linked against, normally the one from your distribution. So the claim that circulated on social media is correct: Linux servers are not covered by the Windows rebuild, and they need the Brotli update from their distribution. Brotli can also reach a PHP process through other libraries, for example FreeType (WOFF2 web fonts), libjxl (JPEG XL images through ImageMagick and Imagick) or extensions that handle compressed HTTP traffic themselves.

Who Else Is Affected

• Node.js bundles its own Brotli. The decoder is reached through Brotli decompression in node:zlib, for example zlib.brotliDecompress() and zlib.createBrotliDecompress(). Fixed releases: 22.23.4, 24.22.1 and 26.12.1. Only these three release lines received fixes, so applications on other lines should move to one of them.
• Anything else that links the system Brotli library, such as the curl command-line tool on many distributions. Updating the system package fixes all of them at once, after a restart.
• Bundled copies in application packages, container images and third-party builds. A system update does not touch these; they are fixed when their vendor ships a new build.

Fixed Versions at a Glance

Severity labels differ between sources: the CVE record scores it 9.2 (critical), AlmaLinux rates its update Important, Ubuntu gives it Medium priority and Node.js rates it High. The difference comes from how likely each vendor considers it that untrusted Brotli data reaches the decoder on their platform. Patch it either way.

How to Check and Patch a Linux Server

1. Update the system Brotli library

On Debian and Ubuntu:

apt-get update
apt-get install --only-upgrade libbrotli1
dpkg -l 'libbrotli*'

On AlmaLinux, Rocky Linux and other RHEL-based systems:

dnf upgrade --refresh brotli
rpm -q brotli

Compare the installed version with the table above.

2. Find out which Brotli your PHP actually uses

# Brotli version libcurl reports to PHP (prints "none" if libcurl was built without Brotli)
php -r 'echo curl_version()["brotli_version"] ?: "none", PHP_EOL;'

# Which libraries the PHP binary loads
ldd "$(command -v php)" | grep -i brotli

# Every copy of the Brotli decoder on the machine
find / -xdev -name 'libbrotlidec.so*' 2>/dev/null

If find shows copies outside the system library directories (for example under /opt or /usr/local), those belong to a separately installed product. Your distribution update does not replace them; check with that product's vendor. Remember that PHP-FPM and the PHP command line can be different builds, so check the binary your websites actually run.

3. Restart everything that still has the old library loaded

Running processes keep the old library in memory until they restart. This lists processes that still map a Brotli library which has since been replaced on disk:

grep -l 'libbrotli.*(deleted)' /proc/[0-9]*/maps 2>/dev/null

Restart PHP-FPM, your web server and any long-running application processes that show up. On Debian and Ubuntu, the needrestart tool does the same check for you.

4. Update Node.js

node -v

If the version is older than 22.23.4, 24.22.1 or 26.12.1 on its line, update it and restart the applications that use it.

If You Cannot Patch Right Away

• In PHP code that fetches URLs from servers you do not control, leave automatic decompression off: do not set CURLOPT_ENCODING for those requests. HTTP client libraries can also turn it on, so check their settings too.
• In Node.js, avoid Brotli decompression of input from untrusted sources until the runtime is updated.
• These steps reduce exposure; they do not replace the update.

A Note on Bundled Libraries

This CVE is a good reminder that "update the server" and "update the software on the server" are not always the same thing. PHP builds from third-party repositories, hosting control panels, container images and language runtimes often ship their own copies of libraries such as Brotli, OpenSSL or libcurl, and those copies only change when their vendor ships a new build. That is also how Panelica ships PHP: each PHP version is a self-contained package with its own libraries, so library fixes reach Panelica servers through the panel's System Updates rather than through apt or dnf. Whatever your stack, the find command above is the quickest way to see how many copies of Brotli your server really has.

Frequently Asked Questions

Is CVE-2026-111497 real, and when was it published?

Yes. The fixed Brotli releases (1.2.1, 1.1.1 and 1.0.10) came out on 21 October 2026 and the CVE record was published on 22 October 2026. It describes an out-of-bounds write in the Brotli decoder affecting versions 1.0.3 through 1.2.0, with a CVSS v4.0 score of 9.2.

Is the PHP Brotli vulnerability only a Windows problem?

No. PHP's 26 October update only rebuilt the Windows packages, because those are the PHP builds that ship their own Brotli. On Linux, PHP normally uses the Brotli library from the operating system, so Linux servers are fixed by updating the distribution's Brotli package and restarting PHP and the web server.

Do I need to update PHP on Linux to fix CVE-2026-111497?

Usually not. The PHP version stays the same; what needs updating is the Brotli library PHP loads. The exception is a PHP build that bundles its own copy of Brotli, which only its vendor can fix with a new build.

How do I check if my Linux server is affected by the Brotli vulnerability?

Check the installed Brotli package with dpkg -l 'libbrotli*' on Debian and Ubuntu or rpm -q brotli on RHEL-based systems, compare it with the fixed versions, and run find / -xdev -name 'libbrotlidec.so*' to discover bundled copies outside the system library directories.

Are nginx and Apache Brotli compression affected?

The bug is in the decoder, while web server Brotli modules use Brotli to compress responses, which goes through the encoder. Update the Brotli library anyway, because other programs on the same server may decompress Brotli data.

Is Node.js affected by CVE-2026-111497?

Yes. Node.js bundles Brotli, and the vulnerable decoder is reached through Brotli decompression in node:zlib. The fixed versions are 22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026.

Is CVE-2026-111497 being exploited in the wild?

In the CISA assessment added to the CVE record on 23 October 2026, exploitation was recorded as none and the attack as not automatable. Exploitation needs software that decompresses attacker-supplied Brotli data, but with code execution possible, patching should not wait.

Do I need to restart services after updating Brotli?

Yes. Processes that were already running keep the old library in memory. Restart PHP-FPM, the web server and long-running applications, or use needrestart on Debian and Ubuntu to find the processes that still use the old version.

Related Reading on panelica.com

• PHP2Shell Explained: Root Cause, Fixed Versions and PHP 8.1 Patch