A memory-corruption flaw in Google’s Brotli decoder sits in lots of packages that unpack Brotli-compressed information, amongst them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set as much as decompress Brotli.
Tracked as CVE-2026-111497, the flaw permits crafted compressed information to overwrite previous the tip of a buffer and corrupt a program’s reminiscence, doubtlessly inflicting a crash, a reminiscence leak, or the execution of attacker-controlled code.
Imperva researchers have proven that code can run on one unpatched Node.js construct. The identical has not been demonstrated on the opposite software program, and no real-world assaults have been reported.
The flaw was first disclosed on October 21, when Node.js and Google shipped fixes, and extra have adopted product by product since. As a result of the bug is in Google’s decoder and every program ships its personal copy of it, each one has to replace that replicate by itself.
Brotli is a compression format from Google, used throughout the online to shrink pages and different visitors. The bug is within the C code that unpacks a Brotli stream, so it travels into something that reuses that code, from language runtimes to proxies to Python packages.
Which Software program Is Affected
| Product | Affected | Mounted in | Uncovered when |
|---|---|---|---|
| Google Brotli (C library) | 1.0.3 to 1.2.0 | 1.0.10, 1.1.1, 1.2.1 | code decodes untrusted Brotli |
| Node.js | 22.x, 24.x, 26.x earlier than the repair; 20.x and older (finish of life) | 22.23.4, 24.22.1, 26.12.1 |
fetch() of a br response, or Categorical or body-parser br our bodies
|
| Bun | 1.4.3 and earlier | 1.4.4 |
fetch() of a br response, or node:zlib
|
| Envoy | 1.39.2, 1.38.5, 1.37.7, 1.36.11 | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 | provided that the Brotli decompressor is configured |
| Istio | 1.31.0 to 1.31.1, 1.30.0 to 1.30.5, 1.29.0 to 1.29.8 | 1.31.2, 1.30.6, 1.29.9 | provided that Brotli decompression is enabled |
Python Brotli
|
1.2.0 and earlier | 1.2.1 |
put in, and an HTTP shopper decodes br
|
Python brotlicffi
|
1.2.0.x and earlier | 1.2.1.0 |
put in, and an HTTP shopper decodes br
|
| cdxgen | standalone binaries and pictures, 13.4.0 and 12.8.8 and earlier | 13.5.0, 12.8.9 | standalone binary or picture scanning untrusted enter |
A program is uncovered provided that it decodes Brotli information that another person controls. For Node.js and Bun, that occurs when the built-in fetch() reads a response despatched with Content material-Encoding: br, or when request-body code corresponding to Categorical 5 and body-parser 2 unpacks a Brotli add. A plain Node.js HTTP server doesn’t decode request our bodies by itself.
Envoy and Istio are affected solely when Brotli decompression is enabled, for instance, by an Envoy filter. The place it’s off, the flaw can’t be reached.
In Python, the chance comes from the Brotli or brotlicffi bundle being put in in any respect. As soon as both is current, HTTP shoppers corresponding to requests, urllib3, httpx, and aiohttp decode Brotli responses on their very own, so an software could be uncovered with out ever importing Brotli in its personal code.
An online software firewall helps solely to this point. Vercel, which added firewall guidelines on the day of disclosure, stated these guidelines don’t cowl “responses your capabilities fetch from different servers.” For that path, solely updating the runtime or library closes the opening.
How far the flaw could be pushed relies on the software program. Imperva’s Crimson Workforce, which calls its work Node2Shell, ran attacker-supplied code on an unmodified Node.js 24.22.0 construct for Linux on ARM64, delivering it each as a fetched response and as an Categorical request physique. The exploit took a number of tries, has not been launched, and was not examined on different builds.
OpenAI, whose Codex Safety workforce reported the flaw, describes it as enabling unauthenticated distant code execution in Brotli and lists Node.js, Bun, and Envoy as affected software program. In its account, the flaw works each methods:
an unpatched server that accepts compressed enter might be taken over by a malicious shopper, and an unpatched shopper that accepts compressed enter (corresponding to “curl –compressed”) might be taken over by a malicious server.
No in-the-wild exploitation has been reported. CISA’s October 23 evaluation recorded exploitation as “none” and automation as “no,” and Crimson Hat stated there is no such thing as a dependable public proof-of-concept for working code.
Severity scores differ by who’s scoring. Google, which assigned the CVE, charges it 9.2, or vital, on the CVSS 4.0 scale. Node.js calls it excessive, and Crimson Hat charges it 8.1, or essential.
The repair has an uncommon historical past. The change that closes the flaw was added to Brotli’s supply code on February 27, however no new Brotli launch carried it till October 21. OpenAI stated the foundation trigger “was really mounted within the Brotli supply code in February, nevertheless it wasn’t recognized on the time that it gave rise to a safety vulnerability and there was no more moderen launch of Brotli.”
Node.js credit Khai Tran and Sylvie Mayer of OpenAI’s Codex Safety for reporting the flaw, and maintainers Matteo Collina and Antoine du Hamel for the repair.
What to Do Now
Replace to a set model from the desk above, then restart the service and rebuild any container picture, as a result of a working course of retains the previous decoder till it restarts.
The place you can not replace but, cease decoding untrusted Brotli. OpenAI’s disclosure web page and the safety agency Aikido each suggest:
- Reject incoming requests with Content material-Encoding: br earlier than any proxy or parser decodes the physique.
- Flip off computerized Brotli decoding in HTTP shoppers, and reject Brotli responses earlier than they’re decoded.
- In Python, uninstall the Brotli and brotlicffi packages so shoppers fall again to gzip and deflate.
Dropping br from the Settle for-Encoding header doesn’t assist by itself, as a result of a server can ship Brotli regardless of the shopper asks for. For Node.js, no workaround has been printed, so updating the runtime is the one repair.
System packages are being mounted at totally different instances. Debian mounted its brotli bundle for Debian 13 (trixie) on October 23 in model 1.1.0-2+deb13u1. Amazon Linux 2023 nonetheless listed its brotli and Node.js 24 packages as pending a repair as of October 22.
Dependency scanners might not flag the Python packages but. The CVE document names Google’s Brotli repository, not the PyPI packages, and GitHub’s advisory nonetheless lists no affected bundle, which is what Dependabot reads. Advisory entries for the 2 Python packages, PYSEC-2026-4322 and PYSEC-2026-4323, have been added on October 23, so test the put in variations manually as nicely.
