Advisory
A note with CVSS 9.8 for component BC-CP-SEC-VUL was released by SAP on 28.10.2026. The correction/advisory 3843368 was described with "[CVE-2026-111497] Memory Corruption in Node.js Brotli decoder affecting SAP Business AI Platform" and affects the system type SAP Business AI Platform.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as none.
The vulnerability addressed is memory corruption vulnerability within SAP Business AI Platform.
Risk specification
The Node.js runtime bundled with SAP Business AI Platform (BAIP) workloads allows an attacker to exploit an error-handling flaw in the Brotli decoder's block-switch processing. When attacker-controlled bytes reach the node:zlib Brotli decompression path, they can cause memory corruption (out-of-bounds write), leading to a high impact on confidentiality, integrity, and availability.
Solution
### SAP BTP, Cloud Foundry Runtime
**For buildpack-based applications:** The Node.js buildpack version 1.9.6 (released on 2026-10-22) includes Node.js versions 22.23.4 and 24.22.1 and has been rolled out across all Cloud Foundry landscapes. Run `cf restage <app>` to pick up the patched runtime. For zero downtime on multi-instance applications, use `cf restage <app> --strategy rolling`. A full application redeployment is not required unless the application code is also being changed.
**For Docker-based applications:** Update the Node.js version inside the container image to at least 22.23.4, 24.22.1, or 26.12.1 (whichever matches the current major version), rebuild the container image, and push it again. For Bun workloads, update to Bun 1.4.4 or newer.
### SAP BTP, Kyma Runtime
**For Node.js workloads running inside Kyma containers:** Customers need to update the Node.js version inside the container image to at least 22.23.4, 24.22.1, or 26.12.1 (whichever matches their current major version), rebuild the container image, and push it to their registry. Pushing a new image does not automatically restart running pods. Customers must then roll out the workload so that the running pods are recreated from the patched image, for example, using `kubectl rollout restart deployment/<deployment-name>`, redeploying through their CI/CD or GitOps pipeline, or using `kyma app push` (which builds, pushes, and deploys in one step). For Bun workloads, update to Bun 1.4.4 or newer and roll out the workload in the same way.
### Other Applications and Brotli Consumers
Applications that access the native Brotli library through a different ecosystem should upgrade to a fixed version of the library (1.0.10, 1.1.1, or 1.2.1 or newer), then rebuild and redeploy:
- **PyPI brotli or brotlicffi:** Upgrade to brotli 1.0.10, 1.1.1, or 1.2.1 (whichever matches the current major version), or the latest version of brotlicffi.
- **Other Brotli consumers**, such as .NET System.IO.Compression.Brotli, FFmpeg built with libjxl, ClickHouse HTTP body decoding, and Apache Arrow or pyarrow reading Brotli-compressed Parquet: Use a build linked against a fixed version of the native Brotli library.
For more information, please refer to FAQ document 3844605.
Although an alternative solution exists, it is advisable to apply the correction! This is the workaround,
which was suggested by the SAP security experts: "Please assess the applicability of the workaround to your SAP landscape before implementation. Note that this workaround is a temporary measure and does not provide a permanent solution. SAP strongly recommends applying the corrections outlined in the security note. If immediate patching is not possible, incoming requests containing the Content-Encoding: br header can be rejected at the application layer before the request body is decompressed. The workaround only addresses the inbound HTTP exposure path. It does not cover outbound HTTP responses using Brotli encoding, direct calls to the Brotli decoder from application code, or non-HTTP Brotli consumers (e.g., file decoding or container runtimes that call into libbrotli). Remove the workaround once the patched runtime is in place.".
