Brotli decoder bug drives patching across runtimes and proxies

A memory-corruption vulnerability in Google’s Brotli decoder, tracked as CVE-2026-111497, affects software that decompresses attacker-controlled Brotli data. The affected ecosystem includes Node.js, Bun, the Python Brotli and brotlicffi packages, Envoy, Istio and cdxgen. Google assigned the flaw a CVSS 4.0 score of 9.2, while Node.js rated it high and Red Hat rated it 8.1, or important.

Imperva’s Red Team demonstrated attacker-controlled code execution on an unmodified Node.js 24.22.0 build for Linux on ARM64. Its Node2Shell research delivered the payload through both a fetched Brotli response and an Express request body. The exploit required several attempts, has not been released and was not tested on other builds. No in-the-wild exploitation has been reported.

Exposure depends on Brotli decoding paths

The underlying C decoder writes beyond the end of a buffer when processing crafted compressed data. The resulting memory corruption could cause a crash, expose memory or potentially allow execution of attacker-controlled code. The flaw is reachable only where an application decompresses Brotli content supplied by another party.

In Node.js and Bun, relevant paths include fetch() handling a response with Content-Encoding: br, plus middleware that decompresses Brotli request bodies, such as Express 5 and body-parser 2. A plain Node.js HTTP server does not decompress request bodies on its own. Bun 1.4.3 and earlier are affected; version 1.4.4 contains the fix.

Envoy is affected only where its Brotli decompressor is configured, and Istio is affected only when Brotli decompression is enabled. Python applications can be exposed less visibly: if Brotli or brotlicffi is installed, HTTP clients including requests, urllib3, httpx and aiohttp can automatically decode Brotli responses even when application code does not directly import either package.

Fixed releases require product-by-product updates

The issue stems from code shared from Google’s decoder, but products ship their own copies and must incorporate fixes independently. Google Brotli versions 1.0.3 through 1.2.0 are affected, with fixes in 1.0.10, 1.1.1 and 1.2.1. Node.js fixed supported release lines in 22.23.4, 24.22.1 and 26.12.1.

Envoy fixes include 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Istio fixed versions are 1.31.2, 1.30.6 and 1.29.9. Python Brotli 1.2.1 and brotlicffi 1.2.1.0 address the issue. The corrective source change had existed in Brotli’s repository since February 27, but no release carrying it arrived until October 21.

Immediate mitigation and operational checks

Organizations should update affected runtimes and libraries, rebuild container images and restart services, because existing processes retain the old decoder. Where updates cannot be deployed immediately, the recommended fallback is to stop decoding untrusted Brotli content: reject incoming Content-Encoding: br before a proxy or parser processes it, and disable automatic Brotli decoding in HTTP clients where possible.

For Python environments, removing Brotli and brotlicffi makes clients fall back to gzip and deflate. Removing br from an Accept-Encoding header alone is not sufficient, because a server can still send Brotli content. Dependency tooling may also miss the Python exposure because the CVE record identifies Google’s repository rather than the PyPI packages. The practical business implication is to verify installed package versions and active decompression paths manually, then treat runtime upgrades, image rebuilds and service restarts as one patching task.