AWS Addresses Brotli Decompression Vulnerability (CVE-2026-111497) Impacting Node.js and .NET Runtimes

AWS has issued a security bulletin addressing CVE-2026-111497, a buffer overflow vulnerability found in the native Brotli decompression library. This vulnerability, initially identified and addressed in the October 2026 Node.js security releases, could allow an attacker to execute arbitrary code or read process memory by supplying specially crafted Brotli-compressed input to affected applications. The significance of this vulnerability for practitioners lies in its potential impact on widely used AWS services such as AWS Lambda, AWS App Runner, and AWS CodeBuild, particularly for applications built with Node.js and .NET runtimes. While AWS-managed services like Lambda itself are not directly affected, the runtimes provided for customer functions are. This means that if your serverless functions or containerized applications utilize these runtimes and the Brotli library, they are at risk. The fact that fixes from other vendors are not yet fully available highlights the broader ecosystem-wide challenge and the urgency for AWS users to act on the provided mitigations. This incident fits into the broader trend of supply chain security and the increasing scrutiny on open-source libraries and their dependencies. As cloud-native development heavily relies on numerous third-party components, vulnerabilities in foundational libraries like Brotli can have a cascading effect across a vast number of applications. The shared responsibility model in cloud security dictates that while AWS secures the underlying infrastructure, customers are responsible for the security of their applications and data, including patching their runtimes and dependencies. This is a recurring theme, as seen with other critical vulnerabilities impacting popular libraries and frameworks in recent years. The integration of security updates into managed services, like the updated App Runner runtimes and CodeBuild images, demonstrates AWS's commitment to assisting customers in fulfilling their part of this model. In practice, practitioners should immediately review their AWS Lambda functions, App Runner services, and CodeBuild projects. For Node.js and .NET runtimes, it is crucial to rebuild and redeploy container images from the updated base images provided by AWS. For ZIP package deployments, AWS is rolling out managed runtime updates in phases, but proactive redeployment with patched versions is recommended if you include the Brotli library in your function. Developers using Node.js 24 should note the targeted updates being applied due to a known regression in a recent release, and those on deprecated Node.js versions (18 and 20) are strongly advised to update to a newer, supported version as they will not receive security updates. Furthermore, for CloudWatch Synthetics canaries using Python Selenium, an update is in progress, and customers should monitor the bulletin for further guidance. This situation underscores the importance of continuous vulnerability management and having automated processes for updating dependencies and redeploying applications in cloud environments.