Overview
A memory-corruption flaw in Google's Brotli decoder, tracked as CVE-2026-111497, was disclosed on October 21, 2026, when Node.js and Google shipped fixes. Crafted compressed data can write past the end of a buffer, which can lead to a crash, a memory leak, or execution of attacker-controlled code.
Google rates it 9.2 (critical) on CVSS 4.0. Node.js rates it high, and Red Hat scores it 8.1 (important). Because each product bundles its own copy of the decoder, each must be updated separately.
The flaw works in both directions: a malicious server can compromise a client that accepts compressed responses, and a malicious client can compromise a server that accepts compressed input.
Affected Software
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli (C library) | 1.0.3 to 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Node.js | 22.x, 24.x, 26.x before the fix (20.x and older are EOL) | 22.23.4, 24.22.1, 26.12.1 |
| Bun | 1.4.3 and earlier | 1.4.4 |
| Envoy | Fixes needed in 1.36 to 1.39 lines | 1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0 |
| Istio | 1.29.0–1.29.8, 1.30.0–1.30.5, 1.31.0–1.31.1 | 1.29.9, 1.30.6, 1.31.2 |
| Python Brotli | 1.2.0 and earlier | 1.2.1 |
| Python brotlicffi | 1.2.0.x and earlier | 1.2.1.0 |
| cdxgen | 12.8.8 and earlier; 13.4.0 and earlier | 12.8.9, 13.5.0 |
Debian fixed its brotli package for Debian 13 (trixie) on October 23. Amazon Linux 2023 packages for Brotli and Node.js 24 were still pending as of October 22.
Exposure Conditions
- Node.js and Bun: exposed when built-in
fetch()reads a response sent withContent-Encoding: br, or when Express 5 or body-parser 2 decodes a Brotli request body. Bun is also exposed throughnode:zlib. A plain Node.js HTTP server does not decode request bodies on its own. - Envoy and Istio: exposed only when Brotli decompression is enabled, for example through an Envoy filter.
- Python: merely installing Brotli or brotlicffi is enough. Clients such as requests, urllib3, httpx and aiohttp then decode Brotli responses automatically, even if the application never imports Brotli.
- cdxgen: exposed when standalone binaries or images scan untrusted input.
Research and Exploitation Status
Imperva's Red Team (Node2Shell) demonstrated code execution on an unmodified Node.js 24.22.0 build for Linux on ARM64, delivered both as a fetched response and as an Express request body. The exploit needed several attempts and has not been released. OpenAI Codex Security reported the flaw, and Node.js maintainers Matteo Collina and Antoine du Hamel produced the fix.
No in-the-wild exploitation has been reported. CISA's October 23 assessment recorded exploitation as "none" and automatable as "no", and Red Hat reports no reliable public proof of concept for code execution.
One oddity: the fix landed in Brotli's source on February 27, but no release included it until October 21. OpenAI said the root cause was fixed in February without anyone recognizing it as a security issue.
Mitigation
- Update to a fixed version, then restart services and rebuild container images. A running process keeps the old decoder until restarted.
- Reject requests carrying
Content-Encoding: brbefore any proxy or parser decodes the body. - Disable automatic Brotli decoding in HTTP clients where practical.
- Python: uninstall the Brotli and brotlicffi packages so clients fall back to gzip or deflate.
- Removing
brfromAccept-Encodingis not sufficient, since servers can send Brotli regardless. - Node.js has no published workaround, so updating is the only fix.
Scanner Gaps
The CVE names Google's Brotli repository rather than the PyPI packages, and GitHub's advisory lists no affected package. Dependabot may therefore not flag the Python packages, so check installed versions manually.