AWS details rollout for Brotli decoder flaw CVE-2026-111497

AWS published a security bulletin on CVE-2026-111497, a buffer overflow in the native Brotli decompression library first addressed in Node.js's October 2026 security releases. Decoding specially crafted Brotli-compressed input could let a third party run code or read process memory in an affected application, and AWS notes the issue extends beyond Node.js, with fixes from other vendors not yet fully available.

AWS says its managed Lambda service itself is not affected, but the Lambda runtimes for .NET and Node.js are, and patched container base images are already updated while ZIP package updates are rolling out in phases across regions. Amplify Hosting, App Runner, CloudWatch Synthetics Node.js canaries, CodeBuild curated images, and Elastic Beanstalk are all receiving updated runtimes on varying timelines, some already complete and others targeted for completion around October 30 to 31. Deprecated runtimes like Node.js 18 and 20 will not get a patch.

Customers who manage their own Node.js environments, such as on EC2, ECS, or EKS, are responsible for upgrading to Node.js 22.23.4, 24.22.1, 26.12.1, or later themselves, and AWS says they should also check whether other libraries or applications they use include Brotli decoding as a dependency. For anyone who cannot patch immediately, AWS suggests a WAF rule that blocks inbound requests using Brotli content encoding, deployed first in count mode before switching to block.

Why it matters

The bulletin gives AWS customers a concrete patch and mitigation timeline for a remote code execution flaw that reaches well past Node.js into any Brotli-decoding dependency.

Source: Amazon Web Services