A memory-corruption flaw in Google’s Brotli decoder (tracked as CVE-2026-111497) has rippled through numerous runtimes and libraries that embed the decoder, creating potential crash, memory-leak, or remote code execution vectors when untrusted Brotli-compressed data is processed. The issue was disclosed on October 21 after fixes began appearing in Node.js and Google’s Brotli source, and researchers from Imperva demonstrated code execution against an unpatched Node.js build. No confirmed in-the-wild exploitation has been reported, but the bug’s presence inside a widely reused C decoder means multiple products must update independently to be safe.
Which Software Is Affected
| Product | Affected | Fixed in | Exposed when |
|---|---|---|---|
| Google Brotli (C library) | 1.0.3 to 1.2.0 | 1.0.10, 1.1.1, 1.2.1 | code decodes untrusted Brotli |
| Node.js | 22.x, 24.x, 26.x before the fix; 20.x and older (end of life) | 22.23.4, 24.22.1, 26.12.1 | fetch() of a br response, or Express or body-parser br bodies |
| Bun | 1.4.3 and earlier | 1.4.4 | fetch() of a br response, or node:zlib |
| Envoy | 1.39.2, 1.38.5, 1.37.7, 1.36.11 | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 | only if the Brotli decompressor is configured |
| Istio | 1.31.0 to 1.31.1, 1.30.0 to 1.30.5, 1.29.0 to 1.29.8 | 1.31.2, 1.30.6, 1.29.9 | only if Brotli decompression is enabled |
| Python Brotli | 1.2.0 and earlier | 1.2.1 | installed, and an HTTP client decodes br |
| Python brotlicffi | 1.2.0.x and earlier | 1.2.1.0 | installed, and an HTTP client decodes br |
| cdxgen | standalone binaries and images, 13.4.0 and 12.8.8 and earlier | 13.5.0, 12.8.9 | standalone binary or image scanning untrusted input |
How the flaw works
The bug is a memory-corruption defect in the C code that decodes Brotli streams. When a program processes Brotli-compressed input it does not control, specially crafted compressed data can overwrite memory beyond a buffer’s end. Outcomes vary by environment and exploitation success: a crash, data corruption or, in some circumstances demonstrated by researchers, arbitrary code execution.
Where the risk appears in practice
A product is only exposed if it actually decodes Brotli data that an attacker can control. Examples from the affected list include:
- Clients or servers whose built-in fetch() handles responses with Content-Encoding: br.
- Web frameworks and body parsers (Express 5, body-parser 2) that decompress request bodies.
- Proxies or service meshes (Envoy, Istio) when Brotli decompression is enabled.
- Python environments where Brotli or brotlicffi is installed—HTTP clients will decode br responses automatically even if application code never imports Brotli.
Real-world impact and severity
Imperva showed that attacker-supplied code could run against an unmodified Node.js 24.22.0 build on Linux ARM64; that exploit was not released and wasn’t tested across other builds. OpenAI’s Codex Security team reported the vulnerability and noted it can affect both servers that accept compressed input and clients that accept compressed responses (for example, curl –compressed). No confirmed in-the-wild exploitation has been observed: CISA’s October 23 assessment listed exploitation as “none,” and Red Hat reported no reliable public proof-of-concept for arbitrary code execution at the time of disclosure. Scoring varies: Google assigned CVSS 9.2 (critical), Node.js labeled it high, and Red Hat rated it 8.1 (important).
Fix and disclosure timeline
The corrective change landed in Brotli’s source on February 27, but a new Brotli release that carried the fix did not appear until October 21. Because many projects vendor or bundle the Brotli decoder, each downstream project needed to update its own copy and ship a fixed release. Node.js, Google, and other projects issued fixes beginning on October 21, and additional product updates have followed.
Immediate mitigation and recommended steps
The authoritative fix is to update affected components to the versions listed in the table and then restart processes so the patched decoder is loaded. Additional practical guidance reported by OpenAI and security responders includes:
- Restart services and rebuild containers after updating, since a running process retains the old decoder.
- If you cannot update immediately, stop decoding untrusted Brotli input: reject incoming requests that include Content-Encoding: br before any proxy or parser processes the body.
- Turn off automatic Brotli decoding in HTTP clients and reject Brotli responses before decoding them.
- In Python environments, uninstall the Brotli and brotlicffi packages so clients fall back to gzip/deflate.
- Note: simply removing “br” from Accept-Encoding is not sufficient; servers can still send Brotli. For Node.js, no reliable workaround had been published—updating the runtime is required.
Operational notes for defenders
– Check installed versions against the table and advisory entries (including PYSEC advisories added on October 23 for the Python packages).
– System package timelines differ by distro: for example, Debian fixed brotli for Debian 13 (trixie) on October 23; other distributions may lag.
– Dependency scanners might not flag vulnerable Python packages immediately because the CVE entry refers to the Brotli repository rather than PyPI package names; verify installed versions manually.
Closing perspective
This vulnerability underscores a recurring pattern: a single, widely reused low-level library bug can turn into a cross-ecosystem headache because each downstream project must update independently. The practical defense is straightforward—identify where your stack decodes Brotli, update to the fixed releases, and restart any long-running processes—but it requires coordinated action by developers, operators, and maintainers to close the window of exposure.
Licensed under CC BY-ND 4.0 International