A memory-corruption flaw within Google's **Brotli** decoder has been identified, affecting a broad spectrum of programs that handle Brotli-compressed data. This includes popular runtimes like **Bun**, Python's **Brotli** and **brotlicffi** packages, and **Envoy** proxies configured for Brotli decompression. Tracked as **CVE-2026-111497**, the vulnerability allows for crafted compressed data to overwrite past the end of a buffer. This can corrupt a program's memory, potentially leading to application crashes, information disclosure via memory leaks, or, in severe cases, the execution of attacker-controlled code. Researchers at **Imperva** have successfully demonstrated remote code execution (**RCE**) on an unpatched **Node.js** build, dubbing their exploit chain "Node2Shell." While similar demonstrations haven't been publicly shown for other affected software, and no real-world attacks have been reported, the potential for severe impact is clear. ## Widespread Disclosure and Patching Efforts The flaw was initially disclosed on October 21, with **Node.js** and **Google** promptly releasing fixes. Since then, various other affected products have followed suit. Given that the bug resides in Google's core decoder and each program typically ships its own copy, each vendor must independently update their integrated Brotli library. **Brotli**, a compression algorithm developed by **Google**, is widely deployed across the web to optimize the size of web pages and other network traffic. The vulnerability specifically lies within the C-language code responsible for unpacking a Brotli stream, meaning it propagates to any component or application that reuses this code, from language runtimes to network proxies and Python packages. ## Affected Software and Exposure Vectors | Product | Affected Versions | Fixed in | Exposed When | |---|---|---|---| | **Google Brotli (C library)** | 1.0.3 to 1.2.0 | 1.0.10, 1.1.1, 1.2.1 | Code decodes untrusted Brotli | | **Node.js** | 22.x, 24.x, 26.x (before fix); 20.x and older (EOL) | 22.23.4, 24.22.1, 26.12.1 | `fetch()` of a `br` response, or Express/body-parser `br` bodies | | **Bun** | 1.4.3 and earlier | 1.4.4 | `fetch()` of a `br` response, or `node:zlib` | | **Envoy** | 1.39.2, 1.38.5, 1.37.7, 1.36.11 | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 | Only if Brotli decompressor is configured | | **Istio** | 1.31.0 to 1.31.1, 1.30.0 to 1.30.5, 1.29.0 to 1.29.8 | 1.31.2, 1.30.6, 1.29.9 | Only if Brotli decompression is enabled | | **Python `Brotli`** | 1.2.0 and earlier | 1.2.1 | Installed, and an HTTP client decodes `br` | | **Python `brotlicffi`** | 1.2.0.x and earlier | 1.2.1.0 | Installed, and an HTTP client decodes `br` | | **cdxgen** | Standalone binaries/images, 13.4.0 and 12.8.8 and earlier | 13.5.0, 12.8.9 | Standalone binary or image scanning untrusted input | Exposure to the vulnerability occurs when a program decodes Brotli data originating from an untrusted source. For **Node.js** and **Bun**, this can happen when the built-in `fetch()` API processes a response with `Content-Encoding: br`, or when request-body parsers like **Express 5** and **body-parser 2** unpack Brotli-compressed uploads. It's important to note that a standard **Node.js** HTTP server does not automatically decode request bodies. **Envoy** and **Istio** are only vulnerable if Brotli decompression is explicitly enabled, for instance, through an **Envoy** filter. If this feature is disabled, the flaw cannot be exploited. In the **Python** ecosystem, the risk arises simply from the presence of the **Brotli** or **brotlicffi** packages. Once installed, HTTP clients such as `requests`, `urllib3`, `httpx`, and `aiohttp` will automatically decode Brotli responses. This means an application can be exposed even if it never explicitly imports or uses the Brotli library in its own code. ## Exploitability and Severity While a web application firewall (**WAF**) can offer some protection, its coverage may be limited. **Vercel**, for example, implemented **WAF** rules on the day of disclosure but acknowledged that these rules do not protect against responses fetched by functions from other servers. In such scenarios, updating the runtime or library remains the only comprehensive fix. **Imperva's Red Team** successfully demonstrated RCE (Node2Shell) on an unmodified **Node.js 24.22.0** build for Linux on ARM64, delivering the exploit both as a fetched response and an **Express** request body. The exploit required multiple attempts and has not been publicly released or tested on other builds. **OpenAI's Codex Security** team, who reported the flaw, describes it as enabling unauthenticated RCE in **Brotli**, affecting **Node.js**, **Bun**, and **Envoy**. They highlight that the flaw can be exploited bi-directionally: "an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as 'curl --compressed') could be taken over by a malicious server." As of now, there have been no reports of in-the-wild exploitation. The **CISA**'s October 23 assessment recorded exploitation as "none" and automation as "no." **Red Hat** also stated that there is no reliable public proof-of-concept for code execution. Severity ratings for **CVE-2026-111497** vary. **Google**, the CVE assigning authority, rates it 9.2 (Critical) on the CVSS 4.0 scale. **Node.js** classifies it as High, while **Red Hat** assigns a rating of 8.1 (Important). Intriguingly, the fix for this vulnerability has an unusual history. The critical change was integrated into **Brotli**'s source code in February but was not included in an official **Brotli** release until October 21. **OpenAI** noted that the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli." **Node.js** credits Khai Tran and Sylvie Mayer of **OpenAI's Codex Security** for reporting the flaw, with maintainers Matteo Collina and Antoine du Hamel for implementing the fix. ## Immediate Actions for IT Security Professionals 1. **Update Immediately**: Upgrade all affected software to the fixed versions listed in the table above. After updating, restart the relevant services and rebuild any container images, as running processes will retain the old decoder until restarted. 2. **Mitigation Where Updates Are Not Possible**: If immediate updates are not feasible, implement measures to prevent the decoding of untrusted Brotli data. **OpenAI's disclosure page** and the security firm **Aikido** recommend the following: * Reject incoming requests with `Content-Encoding: br` headers *before* any proxy or parser attempts to decode the body. * Disable automatic Brotli decoding in HTTP clients and reject Brotli responses before they are processed. * For Python environments, uninstall the `Brotli` and `brotlicffi` packages. This will force HTTP clients to fall back to other compression methods like gzip and deflate. It's crucial to understand that simply dropping `br` from the `Accept-Encoding` header is insufficient, as a server can still send Brotli-compressed data regardless of client preferences. For **Node.js**, no direct workaround has been published, making runtime updates the sole effective fix. System packages are being updated at varying paces. **Debian** fixed its `brotli` package for **Debian 13 (trixie)** on October 23 in version 1.1.0-2+deb13u1. As of October 22, **Amazon Linux 2023** still listed its `brotli` and **Node.js 24** packages as pending a fix. Dependency scanners may not yet fully flag the Python packages. The **CVE** record primarily references Google's **Brotli** repository, and **GitHub's** advisory initially listed no affected package (which **Dependabot** reads). Advisory entries for the two Python packages, **PYSEC-2026-4322** and **PYSEC-2026-4323**, were added on October 23. Therefore, manual verification of installed versions is also recommended.