Detection work for a decoder bug starts with an uncomfortable admission: if CVE-2026-111497 is exploited successfully, the most likely observable event is a process that dies, and most organisations already have thousands of those.
The mechanics that shape the signal
The bundled Brotli decoder treats an invalid block switch as a temporary need for more input rather than a permanent format error. A caller feeding the stream keeps appending bytes into an eight-byte internal buffer, and the write eventually runs past its end. The advisory lists three consequences: a crash, disclosure of process memory, and remote code execution.
Each consequence produces a different telemetry shape, and only one of them is loud.
Crash-driven signals
A malformed Brotli stream sent to an endpoint that inflates request bodies can terminate the worker. In a Node.js service the usual fingerprints are an uncaught native failure that bypasses the framework's error handler, an exit code inconsistent with ordinary application errors, and a restart loop concentrated on one route.
Useful pivots are the request log line immediately before the crash, the Content-Encoding value on that request, and the client address. A single malformed body producing one crash is a bug report. Repeated malformed bodies from one source against the same route is a probe.
Memory disclosure signals
Disclosure is harder to see because it arrives as normal-looking output. If an attacker can read past the buffer, the leaked bytes appear in a response the application happily returns: a parsing error message containing garbage, a decoded string with unexpected binary, a field that should have contained JSON.
Detection here is largely anomaly work. Look for responses whose decoded content fails validation in a way that includes high-entropy byte sequences, and for endpoints that return decoder diagnostics to clients at all. An application that echoes internal exception text is handing over a channel for anything the decoder leaks.
Execution signals
Remote code execution would look like a process doing something it never did before: an outbound connection from a service that only talks to its database, a child process spawned from a decoding worker, a file written outside the working directory.
These are generic signals, and they only help when the surrounding baseline is good enough to notice the deviation. That is a reason to build the detection story before the incident rather than during it.
The telemetry that has to exist first
Three fields carry most of the value and are frequently missing.
Compression method per request. An HTTP log that records content length but not Content-Encoding cannot separate a Brotli endpoint from a JSON one.
Decoder failure reason. The application should log that decompression failed and why, without echoing the payload.
Runtime version per instance. A hunt that cannot distinguish patched from unpatched processes produces noise on both sides.
What to query this week
Start with a simple inventory question: which services accept compressed request bodies and which of them run a Node.js runtime line below the fixed release. Then add the crash correlation: process exits within a short window after a request carrying Brotli content, grouped by route and client.
Neither query proves exploitation. Together they turn a theoretical advisory into a short list of places worth watching.
The defect was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security and fixed by mcollina and aduh95. For defenders, the lesson is that memory-safety bugs in parsers are decided as much by logging design as by patch timing.