On a FreeBSD server, the Brotli flaw CVE-2026-111497, which the US Cybersecurity and Infrastructure Security Agency (CISA) added to its catalogue of exploited vulnerabilities on 27 October 2026, can be closed with four commands and one package upgrade, because the 64 packages in the FreeBSD 15 repository that use Brotli all link the same shared library. Vivian Voss lays out the process in an analysis that opensecurity has covered, and it contrasts sharply with platforms that bundle their own copy of the library.

Key points on patching Brotli on FreeBSD in 20 seconds

The flaw affects Brotli before 1.2.1 and CISA flagged it as exploited on 27 October 2026.
On FreeBSD, pkg audit -F, pkg shlib -R, pkg upgrade and service -R cover it.
Copies of Brotli bundled in pip wheels and Electron apps, as well as each jail, still need separate attention.

The bug is an out-of-bounds write in the decoder of Brotli, Google’s compression library, that an unauthenticated attacker can trigger with crafted compressed data. The Canadian Centre for Cyber Security lists affected versions before 1.0.10, 1.1.1 and 1.2.1 in each branch, and names Node.js, .NET, PowerShell, Bun, Envoy and Istio among affected software. According to BleepingComputer, US federal agencies have until 10 November to patch, and the usual advice is to find every Brotli installation, starting with internet-facing systems.

Four commands instead of an inventory

On FreeBSD, the package manager does the inventory. pkg audit -F fetches the project’s vulnerability database and flags the installed Brotli package; according to Voss, the entry for versions below 1.2.1 went in on 22 October. pkg shlib -R followed by the Brotli library name lists every package that requires it, node24, curl, apache24 and freetype2 among them.

pkg upgrade then replaces the library, and its manual page explains that every package requiring that shared library is added to the work list as a reinstallation job. Finally, service -R restarts local services so no running process keeps the old code in memory. By Voss’s account, the port moved to Brotli 1.2.1 on 23 October, so the fix had been available for four days when CISA listed the flaw.

Why it works, and where it stops

The approach rests on a ports rule. The FreeBSD Porter’s Handbook has a section on why bundled libraries are bad, and its first reason is exactly this case: an upstream fix may not reach the copy bundled with the port. Ports therefore use the system library through LIB_DEPENDS wherever possible, and the Node.js port builds with --shared-brotli. Voss notes that the node24 package was still at 24.21.0, without Node’s own October fixes, yet its Brotli was already patched because the decoder was never inside the binary. Node.js lists 24.22.1 as the fixed release in that branch, according to Help Net Security, so node24 should still be upgraded when it reaches the repository.

There are limits. Python wheels from pip and Electron apps bundle their own copies on FreeBSD too; binary packages trail the ports tree by a few days; each jail has to run its own pkg upgrade; and exceptions such as Wine need the ports team’s approval. On Linux, Debian also shares the library and has fixed it, but anyone running the official Node.js binary gets a bundled copy that waits on Node’s own release. For another example of FreeBSD keeping things lean, see how FreeBSD reads cloud-init configuration without 46 extra packages.