A memory-corruption flaw in Google’s Brotli decoder sits in lots of applications that unpack Brotli-compressed knowledge, amongst them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set as much as decompress Brotli.
Tracked as CVE-2026-111497, the flaw permits crafted compressed knowledge to overwrite previous the tip of a buffer and corrupt a program’s reminiscence, doubtlessly inflicting a crash, a reminiscence leak, or the execution of attacker-controlled code.
Imperva researchers have proven that code can run on one unpatched Node.js construct. The identical has not been demonstrated on the opposite software program, and no real-world assaults have been reported.
The flaw was first disclosed on October 21, when Node.js and Google shipped fixes, and extra have adopted product by product since. As a result of the bug is in Google’s decoder and every program ships its personal copy of it, each one has to replace that replicate by itself.
Brotli is a compression format from Google, used throughout the online to shrink pages and different visitors. The bug is within the C code that unpacks a Brotli stream, so it travels into something that reuses that code, from language runtimes to proxies to Python packages.
Which Software program Is Affected
| Product | Affected | Mounted in | Uncovered when |
|---|---|---|---|
| Google Brotli (C library) | 1.0.3 to 1.2.0 | 1.0.10, 1.1.1, 1.2.1 | code decodes untrusted Brotli |
| Node.js | 22.x, 24.x, 26.x earlier than the repair; 20.x and older (finish of life) | 22.23.4, 24.22.1, 26.12.1 |
fetch() of a br response, or Categorical or body-parser br our bodies
|
| Bun | 1.4.3 and earlier | 1.4.4 |
fetch() of a br response, or node:zlib
|
| Envoy | 1.39.2, 1.38.5, 1.37.7, 1.36.11 | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 | provided that the Brotli decompressor is configured |
| Istio | 1.31.0 to 1.31.1, 1.30.0 to 1.30.5, 1.29.0 to 1.29.8 | 1.31.2, 1.30.6, 1.29.9 | provided that Brotli decompression is enabled |
Python Brotli
|
1.2.0 and earlier | 1.2.1 |
put in, and an HTTP consumer decodes br
|
Python brotlicffi
|
1.2.0.x and earlier | 1.2.1.0 |
put in, and an HTTP consumer decodes br
|
| cdxgen | standalone binaries and pictures, 13.4.0 and 12.8.8 and earlier | 13.5.0, 12.8.9 | standalone binary or picture scanning untrusted enter |
A program is uncovered provided that it decodes Brotli knowledge that another person controls. For Node.js and Bun, that occurs when the built-in fetch() reads a response despatched with Content material-Encoding: br, or when request-body code similar to Categorical 5 and body-parser 2 unpacks a Brotli add. A plain Node.js HTTP server doesn’t decode request our bodies by itself.
Envoy and Istio are affected solely when Brotli decompression is enabled, for instance, by way of an Envoy filter. The place it’s off, the flaw can’t be reached.
In Python, the danger comes from the Brotli or brotlicffi package deal being put in in any respect. As soon as both is current, HTTP shoppers similar to requests, urllib3, httpx, and aiohttp decode Brotli responses on their very own, so an software might be uncovered with out ever importing Brotli in its personal code.
An online software firewall helps solely to this point. Vercel, which added firewall guidelines on the day of disclosure, mentioned these guidelines don’t cowl “responses your features fetch from different servers.” For that path, solely updating the runtime or library closes the opening.
How far the flaw might be pushed relies on the software program. Imperva’s Crimson Staff, which calls its work Node2Shell, ran attacker-supplied code on an unmodified Node.js 24.22.0 construct for Linux on ARM64, delivering it each as a fetched response and as an Categorical request physique. The exploit took a number of tries, has not been launched, and was not examined on different builds.
OpenAI, whose Codex Safety workforce reported the flaw, describes it as enabling unauthenticated distant code execution in Brotli and lists Node.js, Bun, and Envoy as affected software program. In its account, the flaw works each methods:
an unpatched server that accepts compressed enter could possibly be taken over by a malicious consumer, and an unpatched consumer that accepts compressed enter (similar to “curl –compressed”) could possibly be taken over by a malicious server.
No in-the-wild exploitation has been reported. CISA’s October 23 evaluation recorded exploitation as “none” and automation as “no,” and Crimson Hat mentioned there isn’t a dependable public proof-of-concept for working code.
Severity scores differ by who’s scoring. Google, which assigned the CVE, charges it 9.2, or important, on the CVSS 4.0 scale. Node.js calls it excessive, and Crimson Hat charges it 8.1, or essential.
The repair has an uncommon historical past. The change that closes the flaw was added to Brotli’s supply code on February 27, however no new Brotli launch carried it till October 21. OpenAI mentioned the basis trigger “was really fastened within the Brotli supply code in February, however it wasn’t identified on the time that it gave rise to a safety vulnerability and there was no newer launch of Brotli.”
Node.js credit Khai Tran and Sylvie Mayer of OpenAI’s Codex Safety for reporting the flaw, and maintainers Matteo Collina and Antoine du Hamel for the repair.
What to Do Now
Replace to a set model from the desk above, then restart the service and rebuild any container picture, as a result of a working course of retains the outdated decoder till it restarts.
The place you can’t replace but, cease decoding untrusted Brotli. OpenAI’s disclosure web page and the safety agency Aikido each suggest:
- Reject incoming requests with Content material-Encoding: br earlier than any proxy or parser decodes the physique.
- Flip off computerized Brotli decoding in HTTP shoppers, and reject Brotli responses earlier than they’re decoded.
- In Python, uninstall the Brotli and brotlicffi packages so shoppers fall again to gzip and deflate.
Dropping br from the Settle for-Encoding header doesn’t assist by itself, as a result of a server can ship Brotli regardless of the consumer asks for. For Node.js, no workaround has been revealed, so updating the runtime is the one repair.
System packages are being fastened at totally different occasions. Debian fastened its brotli package deal for Debian 13 (trixie) on October 23 in model 1.1.0-2+deb13u1. Amazon Linux 2023 nonetheless listed its brotli and Node.js 24 packages as pending a repair as of October 22.
Dependency scanners might not flag the Python packages but. The CVE file names Google’s Brotli repository, not the PyPI packages, and GitHub’s advisory nonetheless lists no affected package deal, which is what Dependabot reads. Advisory entries for the 2 Python packages, PYSEC-2026-4322 and PYSEC-2026-4323, had been added on October 23, so test the put in variations manually as nicely.
