A memory corruption vulnerability in Google’s Brotli decoder has been found affecting multiple software platforms that rely on Brotli compressed data processing, including Node.js, Bun, Python Brotli packages and Envoy proxies configured for Brotli decompression. Tracked as CVE-2026-111497, the flaw could allow specially crafted compressed data to overwrite memory beyond allocated boundaries, potentially leading to application crashes, information exposure or attacker-controlled code execution in affected environments. Security researchers from Imperva demonstrated that code execution was possible on one unpatched Node.js build through the vulnerability, although similar exploitation has not been demonstrated against other affected software. No real-world attacks involving CVE-2026-111497 have been reported. The issue was initially disclosed on October 21, when Node.js and Google released fixes, followed by additional updates from other software maintainers. Since the vulnerability exists within Google’s Brotli decoder implementation, each project using its own copy of the code must apply separate updates to address the issue.
Brotli is a compression format developed by Google and is widely used across the web to reduce the size of webpages and other data transfers. The vulnerability exists in the C code responsible for decoding Brotli streams, meaning any application that integrates this component may become affected when processing untrusted compressed data. Impacted software includes Node.js versions before the available security updates, Bun versions 1.4.3 and earlier, Envoy versions with Brotli decompression enabled, Istio deployments using affected versions, Python Brotli and brotlicffi packages, along with cdxgen versions that process untrusted input. Updated versions have been released by respective maintainers to address the issue. The risk depends on how each software component handles Brotli data. In Node.js and Bun environments, exposure can occur when applications use fetch requests receiving responses compressed with Brotli or when request processing tools decode Brotli compressed uploads. A standard Node.js HTTP server does not automatically decode request bodies, reducing exposure in those cases. Envoy and Istio deployments are affected only when Brotli decompression features are enabled. In Python environments, applications using Brotli or brotlicffi packages may become exposed when HTTP clients automatically decode Brotli responses, even if developers do not directly import the packages in their own code.
Researchers explained that web application firewalls may provide limited protection because they cannot cover every scenario involving applications fetching compressed responses from external sources. Updating affected runtimes, libraries and dependencies remains the recommended approach. Imperva’s research team, which identified the Node.js exploitation scenario as Node2Shell, demonstrated code execution on an unpatched Node.js 24.22.0 build running on Linux ARM64. The exploit was delivered through a fetched response and an Express request body, but the exploit code has not been publicly released and has not been tested across all affected software. OpenAI’s Codex Security team reported the vulnerability and noted that the issue could affect both servers processing compressed input from malicious clients and clients processing compressed data from untrusted servers. Security assessments have not identified active exploitation, and organizations are advised to update affected software versions and restart services after applying fixes to ensure older decoder versions are no longer running.
Google has rated CVE-2026-111497 as critical with a CVSS 4.0 score of 9.2, while other organizations have assigned different severity levels based on their assessment methods. The security fix was added to Brotli source code earlier in the year, but the vulnerability was only identified later as a security issue. Software maintainers including Node.js have credited security researchers and contributors involved in reporting and resolving the flaw. Organizations unable to immediately update are advised to reduce exposure by preventing untrusted Brotli data from being decoded, disabling automatic Brotli decoding where possible and reviewing installed dependencies. Updating Brotli libraries, Node.js versions, Python packages and other affected components remains the primary recommendation to address CVE-2026-111497 and strengthen application security.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
