Brotli exploitation warning: what AWS Lambda teams need to verify

The 29 October warning changes the priority

New Zealand's NCSC warned on 29 October 2026 that CVE-2026-111497 affects the Brotli decoder and said it was aware of active exploitation. Organizations processing untrusted Brotli-compressed input should prioritize an inventory and updates rather than treating this solely as a theoretical issue.

Canada issued its advisory on 28 October. AWS published its rollout bulletin on 28 October PDT, already 29 October in Vietnam. This article is published on 30 October and distinguishes those developments from Node.js security releases published on 21 October.

The flaw involves an out-of-bounds memory write that can enable code execution within an affected process. A public proof of concept alone would not establish exploitation; the NCSC statement supplies that separate evidence.

Which systems need inspection?

Canada lists affected Brotli branches as versions from 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. The respective fixes are 1.0.10, 1.1.1 and 1.2.1. The CVE record gives a CNA CVSS 4.0 score of 9.2, Critical; individual product assessments can differ.

Exposure depends on an affected decoder processing untrusted data. Inspect product advisories for Node.js, .NET, Python bindings and bundled libraries. The warning does not establish that every Google application, compressed response or AWS account is compromised.

An upload service and an application fetching third-party responses can reach a decoder through different paths. Inventory incoming requests, upstream responses, container contents, layers and application-bundled dependencies.

A managed AWS service is not proof of a patched runtime

AWS bulletin 2026-155 separates the managed Lambda service from function runtimes: AWS assesses the managed service as unaffected, while Node.js and .NET runtimes are affected. Its Python, Ruby and provided.al2023 runtimes do not include the library, but customer-bundled dependencies still require inspection.

The published rollout varies by phase and Region. ZIP functions receive automatic runtime updates in stages. A genuine code or configuration change can receive a new runtime in the initial phase; a no-op update is insufficient. A scheduled completion date is not evidence that every Region has finished.

Container functions require a patched base image followed by rebuilding and redeployment. App Runner customers should follow the bulletin's redeployment conditions. Publishing a new base image does not replace an existing customer container.

Verify the patch evidence, not just the Node version

AWS describes a Node.js 24 backport following an upstream regression, so process.version alone can misidentify patch status. For Lambda, compare cold-start INIT_START runtime evidence with the current AWS bulletin.

At the cited announcement point, AWS identifies nodejs:22.mainline.v157 and nodejs:24.mainline.v114 or higher for those branches. Record the Region, packaging type, actual runtime and deployment time; do not assume an identical rollout everywhere.

Blocking inbound Content-Encoding: br at a web application firewall can reduce one input path. It does not cover responses fetched from external systems and may disrupt legitimate uploads. WAF rules do not replace library updates.

Prioritize by actual exposure

Friday Works recommends starting with services that decompress external data, then identifying the library actually loaded. Assign an owner, rollback plan and post-deployment evidence to each change. Do not test exploitation against systems belonging to others.

After updating, check dependencies or container digests, restart affected processes where required, and test legitimate uploads, partner responses and decompression error handling with harmless authorized fixtures. Preserve suspicious logs and follow incident-response procedures; patching alone cannot establish that earlier compromise did not occur.

Rollout information can change after the cited 28–29 October sources. Re-read the current vendor bulletin before a production change. This report does not certify the patch or compromise status of an individual system.

Further implementation reading

Friday Works provides implementation information and evaluation steps for business systems.