Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy
Original title: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.
A buffer overflow in Google's Brotli C decoder, CVE-2026-111497, can crash a process, leak memory, or run attacker-controlled code when a program unpacks untrusted Brotli data. Each product ships its own copy, so Node.js, Bun, Envoy, Istio, Python's Brotli and brotlicffi packages, and cdxgen must update separately. Imperva ran code on one unpatched Node.js build; that exploit was not released, and no in-the-wild attacks are reported. Fixes began shipping on October 21.
Unconfirmed: Code execution was shown only on one Node.js build; Red Hat says there is no reliable public proof-of-concept.
- Google Brotli 1.0.3 to 1.2.0 is fixed in 1.0.10, 1.1.1, and 1.2.1.
- Node.js fixes are 22.23.4, 24.22.1, and 26.12.1; 20.x is end of life.
- Envoy and Istio are reachable only if Brotli decompression is enabled.
- Imperva ran code on unmodified Node.js 24.22.0 for Linux on ARM64.
- The source fix dated to February 27 but no release carried it until October 21.
Impact: Memory corruption that can crash, leak memory, or run code
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli C library | 1.0.3 to 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Node.js | 22.x, 24.x, 26.x before the fix; 20.x and older | 22.23.4, 24.22.1, 26.12.1 |
| Oven Bun | 1.4.3 and earlier | 1.4.4 |
| Envoy | 1.39.2, 1.38.5, 1.37.7, 1.36.11 | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 |
| Istio | 1.31.0 to 1.31.1, 1.30.0 to 1.30.5, 1.29.0 to 1.29.8 | 1.31.2, 1.30.6, 1.29.9 |
| Python Brotli | 1.2.0 and earlier | 1.2.1 |
| Python brotlicffi | 1.2.0.x and earlier | 1.2.1.0 |
| cdxgen | standalone binaries and images, 13.4.0 and 12.8.8 and earlier | 13.5.0, 12.8.9 |
- 1.Update to a fixed release, restart the service, and rebuild container images.
- 2.Reject Content-Encoding: br and turn off automatic Brotli decoding until updated.
- 3.Uninstall Python Brotli and brotlicffi so clients fall back to gzip and deflate.
- CVEs
- CVE-2026-111497
- Vendors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×15 |
From the original article
5 min read at thehackernews.com
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.