# CERT-In warns of Google Brotli decoder bug affecting multiple platforms 2026-10-26T20:46:20+00:00 | Technology | Indian Opinion Desk Corroboration: 3 independent outlets India's Computer Emergency Response Team (CERT-In) has issued a warning about a critical security vulnerability in Google's Brotli decoder, tracked as CVE-2026-111497. The flaw, rated 8.1 on the CVSS scale by Microsoft, could allow attackers to run malicious code, corrupt memory, or cause denial of service on affected systems. It affects Google Brotli C library versions 1.0.3 to 1.2.0, as well as certain versions of Node.js, Bun, Microsoft.NET, Python Brotli packages and Envoy proxies. The vulnerability was first disclosed by the Node.js team on 21 October, with credits to Khai Tran and Sylvie Mayer of OpenAI's Codex Security. OpenAI noted that the root cause was fixed in the Brotli source code in February but was not recognised as a security flaw at the time. Microsoft released out-of-band updates for.NET 8, 9, 10 and 11 on 25 October, urging users to update 'as soon as possible'. Node.js, Python, Bun, Envoy and Istio have also released patches. CERT-In has advised users and organisations to check affected software and apply security updates from respective developers. A Wiz researcher said 91 percent of cloud environments rely on components vulnerable to the flaw, and 82 percent have publicly exposed Node.js instances. OpenAI recommended blocking untrusted Brotli-compressed data until patches are applied. ## Indian Opinion Analysis Times Now's coverage is a neutral advisory summary, repeating CERT-In's list of affected platforms without independent verification or urgency. The Register leads with Microsoft's emergency.NET patch and the 'Exploitation More Likely' assessment, giving it a government-critical bent by foregrounding the slow disclosure and the fact that the bug was fixed in Brotli's source in February but only disclosed now. WION's headline focuses on OpenAI's role and the risk of server seizure, a sensationalist frame that omits CERT-In and Microsoft's patch timeline entirely. The balanced reading: the vulnerability is real and widespread, but there is no evidence of active exploitation yet, and patching is underway across major platforms. The key concrete item is the disclosure date of 21 October 2026 and the advisory to block untrusted Brotli data until fixes are applied. ## Coverage Coverage: 3 sources, 1 government-critical, 1 neutral, 1 sensationalist - timesnownews.com (neutral report) Advisory summary quoting CERT-In verbatim without urgency or critical angle - theregister.com (government critical) Highlights delayed disclosure despite February fix, Microsoft's exploit assessment - wionews.com (sensationalist) Headline frames as server-seizure risk, omits CERT-In and patch details This brief was synthesised by AI from the 3 sources linked above, so one read covers every framing they carry. Tags: Brotli, CERT-In, Google, Node.js, OpenAI Canonical: https://indianopinion.org/cert-in-warns-of-google-brotli-decoder-bug-affecting-multiple-platforms/ License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources. Cite: https://indianopinion.org/cert-in-warns-of-google-brotli-decoder-bug-affecting-multiple-platforms/#story-in-brief How this brief was made: an AI model read the reports linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. Stance labels are editorial classifications of how each outlet framed this story, assigned by the same model, not ratings of the outlets. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/