AWS Addresses Critical Brotli Decompression Vulnerability Affecting Lambda, App Runner, and CodeBuild

AWS has issued a security bulletin regarding CVE-2026-111497, a significant buffer overflow vulnerability found in the native Brotli decompression library. This flaw, initially addressed in Node.js October 2026 security releases, poses a risk of remote code execution or process memory disclosure if specially crafted Brotli-compressed input is decoded by an affected application. This vulnerability is critical for developers and operations teams utilizing AWS Lambda, App Runner, and CodeBuild. While the AWS Lambda managed service itself is not directly affected, its Node.js and .NET runtimes are. This means customers deploying Lambda functions via container images need to rebuild and redeploy their functions using updated base images. For those using ZIP packages, AWS is implementing a phased rollout of updates. AWS App Runner's managed Node.js runtime has been updated, requiring redeployment for services not updated since October 26, 2026. Similarly, AWS CodeBuild is in the process of updating its curated images, with a target completion date of October 30, 2026. This incident underscores the pervasive nature of software supply chain vulnerabilities, even within widely used compression libraries. It aligns with a broader trend in cloud security where shared responsibility models necessitate active participation from customers in patching and updating their application components. The rapid disclosure and patching of such vulnerabilities are crucial, as threat actors are increasingly quick to weaponize newly identified flaws. The fact that this issue extends beyond Node.js and that fixes from other vendors are still pending further emphasizes the widespread impact of such core library vulnerabilities. In practice, practitioners should immediately review their AWS Lambda functions, especially those using Node.js and .NET runtimes, to determine if they are deployed via container images or ZIP packages. For container-based deployments, rebuilding and redeploying with the latest base images is paramount. For App Runner users, a redeployment is necessary if services haven't been updated recently. CodeBuild users should ensure they are either using the latest curated images or rebuild custom images from updated bases. Additionally, implementing AWS WAF rules as a temporary mitigation, though with the understanding that it only inspects inbound requests and may block legitimate traffic, can provide an interim layer of defense. Continuous monitoring for updates from AWS and other vendors regarding this vulnerability is highly recommended.