Critical Brotli decoder flaw impacts Node.js, Python, and HTTP services

A critical vulnerability in the Google Brotli compression library, tracked as CVE-2026-111497, exposes major software runtimes to remote code execution. Disclosed on October 23, 2026, the flaw affects Node.js, Python, Bun, and various infrastructure components like Envoy and Istio. Developers must patch affected libraries or disable Brotli decoding immediately to prevent potential server compromise.

What happened

The vulnerability, initially dubbed "Node2Shell" when disclosed by Node.js on October 22, was found to have broader implications across the software ecosystem. It stems from a memory safety error in the Brotli decoder that allows an unauthenticated attacker to corrupt process memory. By sending a specially crafted compressed data stream, an adversary can crash a service, leak sensitive information, or execute arbitrary code. The Common Vulnerability Scoring System (CVSS) v4.0 rates this issue at 9.2, marking it as critical.

OpenAI revealed that it discovered the root cause in February 2026. Although the underlying bug was fixed in the Brotli source code at that time, it was not recognized as a security vulnerability, so no patched release was issued until now. This delay means that every project bundling its own copy of the Brotli library remained exposed for months. As of October 23, patches have been released for libbrotli, Python, C++, Node.js, Bun, and Envoy, with more updates expected for other dependent applications.

How it works

Brotli is a lossless compression algorithm widely used to reduce the size of web content such as HTML, CSS, and JavaScript during HTTP transmission. The vulnerability resides in the DecodeBlockTypeAndLength() function within the decoder. This function handles block switches, which occur when a data stream changes the Huffman tree it uses for decompression. In vulnerable versions (1.0.3 through 1.2.0), the function returns a simple boolean value that fails to distinguish between a malformed stream and a request for more input data.

Callers on the fast decoding path discard this return value, leading to a state where the decoder continues processing even when it should stop. An attacker can exploit this by crafting a stream that exhausts a block's length and forces an invalid switch. The decoder then performs an out-of-bounds write, overflowing a small working buffer and damaging adjacent memory. The fix introduces a specific error code, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, ensuring the decoder halts immediately upon encountering such format errors.

Key details

• Affected versions: Brotli 1.0.3 through 1.2.0 on all platforms.
• Fixed versions: Brotli 1.2.1, 1.1.1, and 1.0.10; brotlicffi 1.2.1.0.
• Runtime patches: Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4; Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8.
• Python impact: Packages Brotli and brotlicffi are vulnerable if version 1.2.0 or earlier is installed.
• Detection gap: Advisory databases do not yet map the CVE to PyPI packages, so tools like Dependabot may not flag it automatically.
• Attack vector: Remote, unauthenticated access via crafted HTTP requests or responses containing malicious Brotli data.

Why it matters

This vulnerability highlights the risks associated with transitive dependencies in modern software supply chains. Many developers do not explicitly import Brotli in their code, yet popular HTTP clients like requests, httpx, and urllib3 in Python, or the built-in fetch in Node.js, load it automatically when present. This means an application can be vulnerable without any direct reference to the library in its source code. The automatic nature of these dependencies makes it difficult to assess exposure without deep inspection of the dependency tree.

For teams building networked services, the impact is severe because the attack surface includes both inbound and outbound traffic. A malicious client can target a server by sending compressed request bodies, while a malicious server can target a client by returning compressed responses. This bidirectional threat model requires comprehensive patching of all services that handle HTTP traffic, including internal microservices and external-facing APIs. The delay in recognizing the security implication of the February fix further underscores the need for rigorous monitoring of upstream library changes.

What you can do

• Upgrade runtimes: Update Node.js to 22.23.4, 24.22.1, or 26.12.1, and Bun to 1.4.4 or later.
• Update Python packages: Run pip install -U "Brotli>=1.2.1" and pip install -U "brotlicffi>=1.2.1.0" in all environments.
• Rebuild containers: Regenerate lockfiles and rebuild container images to ensure patched versions are included in deployed artifacts.
• Disable decoding: If immediate patching is not possible, disable Brotli decoding by removing br from Accept-Encoding headers and rejecting incoming Content-Encoding: br requests at the proxy level.
• Verify dependencies: Use pipdeptree or similar tools to identify which libraries pull in Brotli as a transitive dependency.
• Monitor advisories: Check vendor-specific security bulletins for operating system packages, as they may backport fixes without changing the upstream version number.