Now Reading: CERT-In warns of Google Brotli decoder bug affecting multiple platforms
-
01
CERT-In warns of Google Brotli decoder bug affecting multiple platforms
CERT-In warns of Google Brotli decoder bug affecting multiple platforms
The Story in Brief
India's Computer Emergency Response Team (CERT-In) has issued a warning about a critical security vulnerability in Google's Brotli decoder, tracked as CVE-2026-111497. The flaw, rated 8.1 on the CVSS scale by Microsoft, could allow attackers to run malicious code, corrupt memory, or cause denial of service on affected systems. It affects Google Brotli C library versions 1.0.3 to 1.2.0, as well as certain versions of Node.js, Bun, Microsoft.NET, Python Brotli packages and Envoy proxies.
The vulnerability was first disclosed by the Node.js team on 21 October, with credits to Khai Tran and Sylvie Mayer of OpenAI's Codex Security. OpenAI noted that the root cause was fixed in the Brotli source code in February but was not recognised as a security flaw at the time. Microsoft released out-of-band updates for.NET 8, 9, 10 and 11 on 25 October, urging users to update 'as soon as possible'. Node.js, Python, Bun, Envoy and Istio have also released patches.
CERT-In has advised users and organisations to check affected software and apply security updates from respective developers. A Wiz researcher said 91 percent of cloud environments rely on components vulnerable to the flaw, and 82 percent have publicly exposed Node.js instances. OpenAI recommended blocking untrusted Brotli-compressed data until patches are applied.
Indian Opinion Analysis
Times Now's coverage is a neutral advisory summary, repeating CERT-In's list of affected platforms without independent verification or urgency. The Register leads with Microsoft's emergency.NET patch and the 'Exploitation More Likely' assessment, giving it a government-critical bent by foregrounding the slow disclosure and the fact that the bug was fixed in Brotli's source in February but only disclosed now. WION's headline focuses on OpenAI's role and the risk of server seizure, a sensationalist frame that omits CERT-In and Microsoft's patch timeline entirely. The balanced reading: the vulnerability is real and widespread, but there is no evidence of active exploitation yet, and patching is underway across major platforms. The key concrete item is the disclosure date of 21 October 2026 and the advisory to block untrusted Brotli data until fixes are applied.
Coverage: 3 sources, 1 government-critical, 1 neutral, 1 sensationalist
Sources (3): timesnownews.com (neutral report), theregister.com (government critical), wionews.com (sensationalist)
This brief was synthesised by AI from the 3 sources linked above, so one read covers every framing they carry. Methodology and corrections.
