CVE-2026-111497 is a memory-corruption flaw in Google’s Brotli decoder, affecting projects including Node.js, Bun, Envoy and Python Brotli packages.
Imperva demonstrated code execution on an unpatched Node.js build; similar execution has not been shown on the other affected software.
The root cause was fixed in source code months before a release carried the fix.
The issue concerns the core code of Brotli, a program used everywhere on the internet to compress files and data so they can be transmitted faster. Because the tool is integrated into many different applications, each program is affected separately and needs its own update.
Which programs are affected?
The list of affected programs includes Node.js, Bun, the Envoy and Istio servers, Python language packages such as Brotli and brotlicffi, and the cdxgen tool.
Security experts have been able to show that an unpatched version of Node.js can execute code using specially crafted data. However, no similar testing has been performed on the other programs on the list, and no real attacks by malicious users have been recorded so far.
READ ALSO
CISA adds two new security vulnerabilities exploited in real attacks
Organizations rate the severity of the issue differently. Google classifies it as critical, while others rate it as high severity.
What administrators and users should do
Fixing the issue requires updating the affected programs to their latest versions. After updating, running programs need to be restarted or any virtual execution environments recreated to ensure that old code is not still active.
For those who cannot update their systems immediately, there are temporary solutions, such as rejecting incoming requests that use this particular compression method or removing the vulnerable packages from Python.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)