Critical DAF-SA-2026-002

Out-of-bounds write in the Brotli decoder (Node.js and Python)

A server reached by a business rule, a model endpoint or a connector could answer with a crafted compressed response that triggers an out-of-bounds write in the Brotli decoder. Fixed in release 2026.10.24-1 (cloud) and image 2026.10.26-1 (self-hosted).

Published
Updated
Severity
Critical
CVE
CVE-2026-111497CVE-2026-105483CVE-2026-106069CVE-2026-106072CVE-2026-105481
Product Affected Fixed in What to do
DocAI Fabric cloud (US and Australia) Releases before 2026.10.24-1 2026.10.24-1, deployed 2026-10-24 Nothing. The fix is deployed.
Self-hosted image Images before 2026.10.26-1 2026.10.26-1, published 2026-10-26 Update the image to 2026.10.26-1 or later.

Description

CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decompression library, which can lead to code execution. DocAI Fabric decodes Brotli-compressed HTTP responses in two places, each with its own copy of the library:

  • Business rules. A rule’s fetch() call to a host in the project’s HTTP allowlist is answered by the rule engine’s Node.js runtime, which decodes the response outside the rule sandbox. Node.js fixed the bug in 24.22.1.
  • Outbound requests from the application. The application’s HTTP clients decode Brotli responses from endpoints a tenant configures: a language model endpoint you added yourself, an import or delivery connector, or a webhook target. The Python Brotli package fixed the bug in 1.2.1.

In both cases the attacker needs a server that DocAI Fabric connects to, so the precondition is permission to configure a project’s business rules and HTTP allowlist, or a tenant’s model endpoints or connectors. On the cloud service, anyone who signs up holds those permissions in their own tenant.

The same Node.js update also fixes three TLS hostname verification bypasses (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072) and a keep-alive response mix-up (CVE-2026-105481). In DocAI Fabric each of these could affect only requests from a rule to its author’s own host.

Fix

Release 2026.10.22-1 moved the cloud service to Node.js 24.22.1, and release 2026.10.24-1 updated the Python Brotli package to 1.2.1. Self-hosted images carry both fixes from 2026.10.26-1. The 2026.10.22-1 image already carried Node.js 24.22.1, but not the Python fix. (Corrected 2026-10-28: this page first said the 2026.10.22-1 image contained the earlier Node.js.)

Workarounds

Until you can update a self-hosted deployment, turn off the HTTP allowlist in each project’s business rules settings, or remove every host you do not control from it (HTTP allowlist), and remove model endpoints, connectors and webhook targets you do not trust.

References

All security advisories