Brotli flaw reaches Node.js, Bun, Python and proxies
The Brotli flaw tracked as CVE-2026-111497 affects software that uses Google's decoder to unpack Brotli-compressed web traffic. Crafted compressed data can write beyond the end of a memory buffer, causing memory corruption, which means data inside a running program can be damaged or altered. The result could be a crash, a memory leak or remote code execution (RCE), where an attacker makes the affected program run their code.
Brotli is a compression format used to reduce the size of web pages and other network traffic. The vulnerable component is the C code that decodes a Brotli stream. Because runtimes, proxies and software packages include their own copies of that code, each project must release its own update. The flaw was disclosed on October 21, when Google and Node.js issued fixes, with updates for other products following separately.
Google Brotli C library versions 1.0.3 through 1.2.0 are affected, with corrected releases available as 1.0.10, 1.1.1 and 1.2.1. For Node.js, the vulnerable branches are 22.x, 24.x and 26.x before their respective fixes. Patched versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20.x and older releases are also affected but have reached end of life. Exposure can occur when fetch() processes a response marked Content-Encoding: br, or when Express 5 or body-parser 2 decompresses a Brotli request body. A basic Node.js HTTP server does not decompress incoming request bodies by itself.
Bun 1.4.3 and earlier is vulnerable through fetch() responses and node:zlib, and the fix is in Bun 1.4.4. Envoy versions 1.39.2, 1.38.5, 1.37.7 and 1.36.11 are affected when its Brotli decompressor is configured; fixed releases are 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Istio is affected in versions 1.31.0 through 1.31.1, 1.30.0 through 1.30.5 and 1.29.0 through 1.29.8 when Brotli decompression is enabled. Its fixes are 1.31.2, 1.30.6 and 1.29.9. If decompression is disabled in Envoy or Istio, the vulnerable code cannot be reached.
Python Brotli 1.2.0 and earlier is fixed in 1.2.1, while brotlicffi 1.2.0.x and earlier is fixed in 1.2.1.0. Applications can be exposed without directly importing either package. When a vulnerable package is installed, HTTP clients including requests, urllib3, httpx and aiohttp can automatically decode Brotli responses received from another server. The cdxgen standalone binaries and images are also affected in versions 13.4.0 and 12.8.8 and earlier when scanning untrusted input; corrected releases are 13.5.0 and 12.8.9.
A program is at risk only when it decodes Brotli data controlled by someone else. That can involve a malicious client sending compressed input to a server, or a malicious server returning compressed content to a client. OpenAI's Codex Security team, which reported the flaw, also identified clients using curl --compressed as an example of the second direction. A web application firewall (WAF), a filter that inspects web requests, cannot necessarily block this outbound path. Vercel introduced firewall rules on the disclosure date but said they do not protect responses that functions fetch from other servers.
Imperva's Red Team demonstrated attacker-controlled code execution on an unmodified Node.js 24.22.0 build for Linux on ARM64. Its Node2Shell work delivered the malicious data both through a fetched response and an Express request body. The exploit required several attempts, has not been published and was not tested against other builds. Code execution has not been demonstrated on the other affected products, and no attacks in the wild have been reported. The Cybersecurity and Infrastructure Security Agency (CISA) recorded no exploitation and no automation in its October 23 assessment, while Red Hat said no reliable public proof of concept for code execution was available.
Severity assessments vary. Google assigned a critical score of 9.2 under the Common Vulnerability Scoring System (CVSS) 4.0. Node.js classified the issue as high severity, while Red Hat scored it 8.1 and labelled it important. The corrective source-code change had been added to Brotli on February 27, but it was not then recognised as a security fix and did not appear in a new Brotli release until October 21.
Administrators should install the appropriate fixed release, restart affected services and rebuild container images, which are packaged copies of an application and its dependencies. A process that remains running continues to use the old decoder. Where an update cannot be applied immediately, OpenAI and Aikido recommend rejecting requests marked Content-Encoding: br before a proxy or body parser decompresses them, disabling automatic Brotli decoding in HTTP clients, and rejecting Brotli responses before decoding. Python operators can remove vulnerable Brotli and brotlicffi packages so clients fall back to gzip or deflate. Removing br from Accept-Encoding is insufficient because a server can return Brotli content regardless of the request. No Node.js workaround has been published, making a runtime update the stated fix.
Operating-system packages may move on different schedules. Debian corrected Brotli for Debian 13 (trixie) on October 23 with version 1.1.0-2+deb13u1. As of October 22, Amazon Linux 2023 still marked its Brotli and Node.js 24 fixes as pending. Dependency tools may also miss the vulnerable Python packages because the CVE record points to Google's repository and GitHub's advisory lists no affected package, which is the information Dependabot uses. PYSEC-2026-4322 and PYSEC-2026-4323 were added for the two Python packages on October 23, so installed versions should also be checked manually. For organisations that need assistance reviewing affected runtimes, packages and infrastructure, AEU-I provides security-first IT, infrastructure and consulting.