A memory-corruption vulnerability in Google’s Brotli decoder has triggered updates across language runtimes, proxies and Python packages, with researchers demonstrating code execution on one unpatched Node.js build.
Tracked as CVE-2026-111497, the flaw becomes reachable when software decompresses attacker-controlled Brotli data. A crafted stream can cause an out-of-bounds write, potentially exposing memory, crashing the application or allowing arbitrary code execution. No exploitation in the wild has been reported.
According to The Hacker News, disclosure began on October 21, 2026, when Google and Node.js released fixes. Other projects have followed with updates to their own copies of the decoder.
Both incoming requests and fetched responses can expose applications
Brotli compresses web pages and other traffic. The vulnerability is in its C decoder, specifically the block-type switch handling in c/dec/decode.c, according to Red Hat’s assessment of CVE-2026-111497. Exploitation requires a malformed stream; ordinary, well-formed encoder output does not trigger the vulnerable path.
In Node.js and Bun, exposure includes built-in fetch() calls that receive Content-Encoding: br responses. Incoming uploads can also reach the decoder through request-body handling such as Express 5 and body-parser 2. A plain Node.js HTTP server does not automatically decompress request bodies.
Python applications can become exposed simply by having the Brotli or brotlicffi package installed: HTTP clients including requests, urllib3, httpx and aiohttp then automatically decode Brotli responses. The application need not import either compression package directly.
Envoy and Istio require Brotli decompression to be enabled. Deployments where it is disabled do not expose this decoder path.
Imperva’s Red Team, calling its research Node2Shell, demonstrated attacker-controlled code execution on an unmodified Node.js 24.22.0 build running Linux on ARM64. It delivered malicious data through both a fetched response and an Express request body. The exploit required multiple attempts, has not been released and was not tested on other builds. That demonstration does not establish working code execution against every affected product.
Red Hat says there is no public, reliable remote code execution proof of concept. It rates the issue Important, with a CVSS 3.1 score of 8.1, citing exploitation requirements and platform hardening that complicate reliable code execution without eliminating other impacts. Envoy rates it Critical at 9.2 under CVSS 4.0, while Node.js classifies it as High.
Fixed releases depend on the product and deployment
The reported fixes for Google’s Brotli C library are 1.0.10, 1.1.1 and 1.2.1. Applications that bundle the library need their own updates; installing a fixed system library does not necessarily replace a bundled decoder.
For other affected software, the reported fixed releases are:
- Node.js: 22.23.4, 24.22.1 and 26.12.1, for the corresponding 22.x, 24.x and 26.x release trains. The report also identifies end-of-life Node.js 20.x and older as affected.
- Bun: 1.4.4; versions 1.4.3 and earlier are affected.
- Istio: 1.31.2, 1.30.6 and 1.29.9, addressing affected ranges 1.31.0–1.31.1, 1.30.0–1.30.5 and 1.29.0–1.29.8 when Brotli decompression is enabled.
- Python Brotli: 1.2.1; versions 1.2.0 and earlier are affected.
- Python brotlicffi: 1.2.1.0; versions 1.2.0.x and earlier are affected.
Envoy’s October 23 advisory identifies affected versions v1.39.2, v1.38.5, v1.37.7 and v1.36.11 on all platforms. It lists fixes in v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12. The advisory limits impact to deployments with the Brotli decompressor configured and says a remote, unauthenticated attacker could corrupt decoder state, disclose memory, cause denial of service or potentially execute code.
cdxgen exposure includes repository scans and server mode
cdxgen’s October 22 advisory covers standalone release binaries and container images that bundle vulnerable runtimes. Its affected release ranges are 13.4.0 and earlier for @cdxgen/cdxgen, and 12.8.8 and earlier for @cyclonedx/cdxgen; patched releases are 13.5.0 and 12.8.9 respectively.
The scope includes all standalone executable families, slim and full, on every platform. Installations through npm, pnpm or npx use the host’s Node.js instead and require a patched host runtime.
With default settings, scanning an untrusted repository can trigger the flaw when its Podfile.lock points to an external :git source. cdxgen fetches the podspec from that host and decompresses a Brotli response even though it did not request one. Secure mode still permits any HTTPS host. Additional paths involve project-supplied npm, Deno or Dart registries with FETCH_LICENSE, and OCI registry probes with --bom-audit.
In --server mode, the /sbom endpoint decompresses Brotli request bodies before validation or authentication.
Both patched cdxgen releases bundle Node.js 24.22.1. Release 12.8.8 was intended to include the security update, but its standalone binaries retained Node.js 24.18.0 and its container images were not published. The advisory directs users to 12.8.9 or later. Updated builds also move cdxgen-secure onto the matching release image, use official Node.js 24.22.1 for cdxgen-ppc64, and use Bun 1.4.4 for cdxgen-bun.
Mitigations must cover data before decompression
Where updates cannot be applied immediately, the documented mitigations focus on preventing untrusted Brotli data from reaching the decoder. These include rejecting incoming Content-Encoding: br requests before decompression, disabling automatic Brotli response decoding where supported, or removing Python’s Brotli and brotlicffi packages so clients fall back to gzip and deflate.
Removing br from Accept-Encoding alone is insufficient: a server can still return Brotli-compressed content. Firewall protection also has limits. Vercel said its disclosure-day rules did not cover responses that functions fetch from other servers. The report says no Node.js workaround has been published, making a runtime update the prescribed fix.
For cdxgen, maintainers additionally recommend restricting destinations with CDXGEN_ALLOWED_HOSTS, setting COCOA_FULL_SCAN=false to skip remote podspec downloads, and keeping server mode inaccessible to untrusted clients. A patched host Node.js with the npm package is another documented option.
After updating, services need restarting and container images need rebuilding to replace the decoder in running processes. Python dependency scanners may lag: the report says GitHub’s advisory lacked affected-package entries, while PYSEC-2026-4322 and PYSEC-2026-4323 were added on October 23. Installed versions therefore warrant a manual check.
The repair itself predates disclosure. OpenAI, whose Codex Security team reported the vulnerability, said the underlying change entered Brotli’s source on February 27 without being recognized as a security fix. No Brotli release carried it until October 21.
