TL;DR
- what: CVE-2026-111497 is an out-of-bounds write in Google's Brotli C decoder, versions 1.0.3 to 1.2.0, triggered by crafted Brotli-compressed data.
- impact: Any program that decodes attacker-controlled Brotli can crash, leak memory or run attacker code, and Imperva has demonstrated remote code execution on unpatched Node.js 24.22.0.
- fix: Fixed in Brotli 1.0.10, 1.1.1 and 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, Bun 1.4.4, Envoy 1.40.0 and backports, Istio 1.31.2, 1.30.6 and 1.29.9, Python Brotli 1.2.1, brotlicffi 1.2.1.0, and cdxgen 13.5.0 and 12.8.9.
- who: Teams running Node.js or Bun services that fetch remote content or accept compressed uploads, Envoy or Istio meshes with Brotli decompression enabled, and any Python application with Brotli or brotlicffi installed.
A memory-corruption flaw in Google's Brotli decompression code, tracked as CVE-2026-111497, gives attackers a way to write past the end of a buffer in any program that decodes Brotli data they control. Google rates it 9.2 (critical) on CVSS 4.0. Imperva's Red Team has turned it into working remote code execution on an unmodified Node.js 24.22.0 build. The vulnerable code also ships inside Bun, Envoy, Istio, cdxgen, and the Python Brotli and brotlicffi packages. Since each project bundles its own copy of the decoder, patching one does nothing for the rest.
Node.js and Google released fixes on October 21, and other vendors have followed one by one. CISA's October 23 assessment recorded exploitation as "none" and automation as "no." Red Hat says there is no reliable public proof-of-concept for code execution. Nobody has reported attacks in the wild yet.
What the Bug Is
Brotli is Google's compression format, used across the web to shrink pages and API traffic. The flaw lives in the C code that unpacks a Brotli stream. A crafted compressed payload makes the decoder write beyond its output buffer and corrupt adjacent memory. The result can be a crash, a memory leak, or execution of attacker-controlled code, depending on the target and how much work the attacker puts in.
Google Brotli versions 1.0.3 through 1.2.0 are affected. The fixed releases are 1.0.10, 1.1.1 and 1.2.1.
Affected Products and Fixed Versions
- Node.js: 22.x, 24.x and 26.x before the fix. Fixed in 22.23.4, 24.22.1 and 26.12.1. Node.js 20.x and older are end of life and will not get a patch.
- Bun: 1.4.3 and earlier. Fixed in 1.4.4.
- Envoy: 1.39.2, 1.38.5, 1.37.7 and 1.36.11. Fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Exposed only when the Brotli decompressor is configured.
- Istio: 1.31.0 to 1.31.1, 1.30.0 to 1.30.5, and 1.29.0 to 1.29.8. Fixed in 1.31.2, 1.30.6 and 1.29.9. Exposed only when Brotli decompression is enabled.
- Python Brotli: 1.2.0 and earlier. Fixed in 1.2.1.
- Python brotlicffi: 1.2.0.x and earlier. Fixed in 1.2.1.0.
- cdxgen standalone binaries and images: 13.4.0, and 12.8.8 and earlier. Fixed in 13.5.0 and 12.8.9. Exposed when scanning untrusted input.
When a System Is Actually Exposed
The flaw can only be reached when a program decodes Brotli data that someone else controls. Where that happens differs by platform.
In Node.js and Bun, the built-in fetch() decodes any response sent with Content-Encoding: br. A service that fetches from third-party or attacker-influenced URLs can be hit by a malicious server. On the inbound side, request-body middleware such as Express 5 and body-parser 2 unpacks Brotli uploads, so an internet-facing API built on them can be hit by a malicious client. Bun is also exposed through node:zlib. A bare Node.js HTTP server does not decode request bodies by itself.
Envoy and Istio are exposed only when Brotli decompression is switched on, for example through an Envoy filter. With decompression off, the vulnerable code never runs.
⚠️ Python exposure without a single import — If the Brotli or brotlicffi package is installed, HTTP clients including requests, urllib3, httpx and aiohttp decode Brotli responses automatically. An application can be exploitable without ever importing Brotli in its own code, simply because a transitive dependency pulled the package into the environment.
OpenAI's Codex Security team, which reported the flaw, describes it as unauthenticated remote code execution that works in both directions. An unpatched server accepting compressed input can be taken over by a malicious client, and an unpatched client accepting compressed responses can be taken over by a malicious server.
Exploitation: Node2Shell
Imperva's Red Team calls its work Node2Shell. The team ran attacker-supplied code on stock Node.js 24.22.0 for Linux on ARM64, delivering the payload two ways: as a fetched HTTP response and as an Express request body. The exploit needed several attempts, has not been published, and was only tested on that one build. Nobody has shown code execution on Bun, Envoy, Istio or the Python packages. For those, the confirmed impact is memory corruption, and the realistic outcome on any given build is anywhere from a crash to code execution.
Scores vary by vendor. Google, the CVE assigner, gives it 9.2 critical on CVSS 4.0. Node.js rates it high. Red Hat scores it 8.1, important.
An Eight-Month Gap Between Fix and Release
The code change that closes the flaw went into Brotli's source on February 27. No Brotli release included it until October 21. According to OpenAI, the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli." So for almost eight months, every downstream project that vendored a tagged Brotli release was carrying a bug that was already fixed upstream.
Node.js credits Khai Tran and Sylvie Mayer of OpenAI's Codex Security with the report, and maintainers Matteo Collina and Antoine du Hamel with the fix.
Vendor Mitigations and Their Limits
Patching closes the hole, but only after a restart. A running process keeps the old decoder in memory, and container images keep the vulnerable library until they are rebuilt. For systems that cannot be updated yet, OpenAI's disclosure page and Aikido recommend rejecting inbound requests carrying Content-Encoding: br before any proxy or parser decodes them, turning off automatic Brotli decoding in HTTP clients, and, in Python, removing the Brotli and brotlicffi packages so clients fall back to gzip and deflate.
Two of the obvious defenses fall short. Dropping br from the Accept-Encoding header does not protect a client, because a server can send Brotli no matter what the client asks for. And Node.js has published no workaround, so updating the runtime is the only fix there.
WAFs do not cover outbound fetches — Vercel added firewall rules on disclosure day but said they do not cover "responses your functions fetch from other servers." A WAF in front of a service only sees inbound traffic. On the outbound fetch path, the only fix is an updated runtime or library.
Patch Status Across Distributions and Scanners
OS packages are getting fixed on different schedules. Debian patched brotli for Debian 13 (trixie) on October 23 in version 1.1.0-2+deb13u1. As of October 22, Amazon Linux 2023 still listed its brotli and Node.js 24 packages as pending a fix. Dependency scanners may also miss the Python exposure, because the CVE record names Google's Brotli repository and not the PyPI packages. A clean scan does not prove a Python environment is safe.
RedEye Assessment
This is a vendored-library problem. Fixing it means finding every copy of the decoder across runtimes, proxies, service meshes, Python environments, base images and build tooling, then confirming each one has been patched and restarted. Outbound fetch paths and transitive Python dependencies are where scanners and WAFs are least likely to catch it. RedEye Security can map where Brotli decoding happens across your environment, identify which exposure paths can actually be reached, and confirm remediation. Contact us to schedule an assessment.
Originally published on RedEye Threat Intelligence.
Top comments (0)