Number: AL26-027
Date: October 28, 2026
Audience
This Alert is intended for IT professionals and managers.
Purpose
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
Details
The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting the Google Brotli compression libraryFootnote 1. In response to the vendor advisory, the Cyber Centre released an advisory on October 26, 2026Footnote 2.
Google Brotli is an open-source compression algorithm developed by Google that reduces the size of web content, such as HTML, CSS, and JavaScript, to improve website loading speed and reduce bandwidth usage.
Tracked as CVE-2026-111497Footnote 3, the vulnerability is an out-of-bounds write (CWE-787)Footnote 4, vulnerability affecting the Google Brotli decoder. Known as “Broccoli2Shell”Footnote 5, the vulnerability could be exploited remotely without authentication by sending specially crafted compressed data. Successful exploitation could result in memory corruption, disclosure of sensitive information, process crashes or arbitrary code execution in affected applications or services.
Because Brotli is widely integrated into other software, organizations should assess applications and products that bundle or rely on vulnerable Brotli components. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages, among others.
On October 27, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026–111497 to their Known Exploited Vulnerabilities (KEV) DatabaseFootnote 6.
Suggested actions
The Cyber Centre strongly recommends that organizations running affected BeyondTrust Remote Support deployments upgrade to the following fixed version:
| Affected Product | Affected versions | Fixed versions |
|---|---|---|
| Brotli | Versions 1.0.3 prior to 1.0.10 | Version 1.0.10 |
| Brotli | Versions 1.1.0 prior to 1.1.1 | Version 1.1.1 |
| Brotli | Versions 1.2.0 prior to 1.2.1 | Version 1.2.1 |
The Cyber Centre recommends that organizations:
- Identify Internet-facing systems, applications and services that use vulnerable Brotli components and prioritize their remediation, including third-party software and dependenciesFootnote 7.
- Apply applicable security updates as soon as possible.
- Where immediate remediation is not feasible, prevent affected applications from processing Brotli-compressed content from untrusted sources until an update can be applied.
- Monitor affected systems for unexpected crashes, abnormal process behaviour or other suspicious activity.
Organizations should also review the Cyber Centre’s Top 10 IT Security ActionsFootnote 8.
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.