Critical Brotli decoder flaw enables remote code execution in Node.js, Bun, and Python

A critical memory-corruption vulnerability in Google’s Brotli compression library has exposed widely used software stacks to potential remote code execution. Disclosed on October 21, 2026, the flaw affects Node.js, Bun, Python packages, and infrastructure proxies like Envoy and Istio. While no active attacks have been reported, researchers have successfully demonstrated code execution on unpatched Node.js builds.

What happened

The vulnerability, tracked as CVE-2026-111497, resides in the C code responsible for decoding Brotli-compressed data. Because many applications and runtimes bundle their own copy of this decoder, the bug propagates across different ecosystems independently. Google assigned a critical severity rating of 9.2 on the CVSS 4.0 scale, while Node.js classified it as high and Red Hat as important. The root cause was actually patched in the Brotli source code on February 27, but it remained unreleased until October 21 because developers did not initially recognize it as a security vulnerability.

Imperva’s Red Team demonstrated that an attacker could execute arbitrary code on an unmodified Node.js 24.22.0 build running on Linux ARM64. They achieved this by sending crafted compressed data via a fetched response or an Express request body. Although this exploit required several attempts and has not been released publicly, it confirms the theoretical risk is practical. OpenAI’s Codex Security team, who reported the flaw, noted that the issue works bidirectionally: malicious clients can compromise servers, and malicious servers can compromise clients.

How it works

Brotli is a compression algorithm developed by Google to reduce the size of web traffic. The vulnerability is a buffer over-read and overwrite flaw in the decoder. When a program processes specially crafted Brotli data, the decoder writes past the end of the allocated memory buffer. This memory corruption can lead to crashes, data leaks, or the execution of attacker-controlled instructions. Since the bug exists in the underlying C library, any software that links against or bundles vulnerable versions of Google’s Brotli code inherits the risk.

Exposure depends on whether the software actively decodes untrusted Brotli streams. In Node.js and Bun, this occurs when using the built-in fetch() API to retrieve responses with Content-Encoding: br, or when middleware like Express 5 and body-parser 2 decompresses request bodies. In Python, the risk is broader; if the Brotli or brotlicffi packages are installed, HTTP clients such as requests, urllib3, and httpx may automatically decode Brotli responses without explicit developer intervention. Infrastructure tools like Envoy and Istio are only vulnerable if Brotli decompression is explicitly enabled in their configuration.

Key details

• CVE Identifier: CVE-2026-111497.
• Affected Node.js versions: 22.x, 24.x, and 26.x before fixes; 20.x and older are end-of-life.
• Fixed Node.js versions: 22.23.4, 24.22.1, and 26.12.1.
• Affected Bun versions: 1.4.3 and earlier; fixed in 1.4.4.
• Affected Python packages: Brotli 1.2.0 and earlier, brotlicffi 1.2.0.x and earlier; fixed in 1.2.1 and 1.2.1.0 respectively.
• Infrastructure: Envoy and Istio are affected only if Brotli decompression is configured and enabled.

Why it matters

For engineering teams, this vulnerability highlights the hidden risks of transitive dependencies and bundled C libraries. Unlike typical JavaScript package vulnerabilities, this flaw lives in the runtime environment itself. Updating a package.json dependency is insufficient if the underlying Node.js or Bun runtime remains unpatched. Furthermore, Python developers may be vulnerable even if they never directly import a Brotli library, as common HTTP clients pull it in automatically. This creates a silent attack surface that standard dependency scanners might miss if they do not inspect system-level or transitive C bindings.

The delayed release of the fix also underscores a gap in open-source maintenance. The code change existed for months without a release, leaving systems exposed despite the patch being written. This scenario complicates incident response, as teams cannot rely solely on automated alerts from package registries. Manual verification of runtime versions and container images is now necessary, especially for services that handle external data or act as clients to other servers.

What you can do

• Update Node.js to 22.23.4, 24.22.1, or 26.12.1, and Bun to 1.4.4 or later.
• Upgrade Python Brotli to 1.2.1 and brotlicffi to 1.2.1.0, or uninstall them if not strictly needed.
• Restart all services and rebuild container images after updating, as running processes retain the old vulnerable library in memory.
• If immediate updates are impossible, configure proxies to reject requests with Content-Encoding: br before they reach the application.
• Disable automatic Brotli decoding in HTTP clients and remove br from Accept-Encoding headers where feasible, though note that servers may still send Brotli content.
• Manually verify installed versions of Python packages, as dependency scanners like Dependabot may not yet flag the specific PyPI packages associated with this CVE.