Critical Brotli Decoder Flaw Exposes Node.js and Bun

A critical Brotli decoder flaw, tracked as CVE-2026-111497, exposes major software runtimes and network proxies to buffer overflows and potential remote code execution (RCE). Disclosed on October 24, 2026 following coordinated vulnerability disclosures, the vulnerability resides in the C library used to decompress Brotli streams across Node.js, Bun, Python environments, and Envoy proxies. By submitting crafted compressed streams, remote attackers can trigger out-of-bounds writes to crash services, leak memory, or execute unauthorized code. Researchers have demonstrated RCE on an unmodified Node.js Linux ARM64 build. Infrastructure teams must immediately deploy runtime updates or disable untrusted Brotli decompression.

Because the vulnerable C code is embedded across individual runtimes rather than dynamically linked from a single system library, each platform must ship its own patch. The flaw highlights persistent supply chain risks when low-level parsing libraries are bundled across diverse application ecosystems.

Memory corruption flaw in Google Brotli decoder

Google developed Brotli as an open-source, lossless compression format for web traffic. The vulnerability lies within c/dec/decode.c inside the DecodeBlockTypeAndLength() function. In versions 1.0.3 through 1.2.0, the decoder’s block-switching logic fails to validate return values properly, combining an unchecked return value (CWE-252) with an out-of-bounds write (CWE-787).

When encountering an invalid block switch, the function returns a status that the decoder’s fast execution path misinterprets as a request for additional input data rather than a syntax error. Attackers can supply a malformed compressed stream that forces the parser to keep writing incoming bytes past the allocated internal buffer, corrupting adjacent heap memory.

Google assigned CVE-2026-111497 a CVSS v4.0 score of 9.2 (Critical), while Node.js rated it High and Red Hat assigned an 8.1 (Important) score. Upstream maintainers originally fixed the underlying logic flaw on February 27, 2026, but the commit was treated as a routine refactor without a security classification, leaving the vulnerability unreleased until October 21. OpenAI Codex Security researchers Khai Tran and Sylvie Mayer uncovered the flaw’s exploitability, coordinating fixes with Node.js maintainers Matteo Collina and Antoine du Hamel.

As with recent runtime vulnerabilities such as the PHP RCE flaws triggering emergency security patches, memory corruption in core runtimes invalidates application-level security assumptions.

Vulnerability exposure across runtimes, proxies, and clients

A service is exposed to CVE-2026-111497 only when it decodes untrusted Brotli data. The attack vector is bidirectional: an unpatched server can be compromised by a malicious client uploading compressed data, and an unpatched client can be compromised by a hostile server returning compressed responses.

In Node.js and Bun, the native fetch() method automatically decompresses HTTP responses served with Content-Encoding: br. On the server side, Node.js applications are vulnerable when using middleware like Express 5 or body-parser 2 to unpack Brotli request bodies. In Python, merely installing the Brotli or brotlicffi package causes popular HTTP clients like requests, urllib3, httpx, and aiohttp to automatically unpack Brotli streams without explicit application imports. Ingress proxies like Envoy and Istio are vulnerable only when Brotli decompression filters are explicitly enabled.

Mitigation strategies and patching hurdles

CISA’s advisory records active exploitation as none and automation as no, and Red Hat reported no reliable public exploit code in circulation. However, Imperva’s Red Team confirmed exploitability through project Node2Shell, achieving arbitrary code execution on an unmodified Node.js 24.22.0 binary on Linux ARM64 via both fetched responses and Express bodies. While private and timing-sensitive, the exploit proves remote weaponization is feasible.

Perimeter web application firewalls offer incomplete protection. Vercel deployed firewall rules upon disclosure, but noted they cannot protect responses that backend functions fetch from external servers. Furthermore, dependency scanners initially missed vulnerable Python packages because the CVE cataloged Google’s C repository rather than PyPI packages; PyPI advisories PYSEC-2026-4322 and PYSEC-2026-4323 were indexed on October 23. Operating system distributions are updating at different tempos; while Debian patched trixie on October 23, while Amazon Linux 2023 packages remained pending as of October 22.

What happens next

Platform teams must update runtime versions and immediately restart running processes and container instances, as running services retain the old decoder in memory until rebooted. Where patching cannot occur immediately, organizations should implement three interim controls:

1. Block incoming compressed bodies: Configure edge proxies to reject incoming requests with Content-Encoding: br prior to body parsing.
2. Disable client Brotli decoding: Disable automatic Brotli decoding in HTTP clients and drop Brotli responses before decompression. Dropping br from Accept-Encoding headers is insufficient, as servers can return Brotli regardless of requested encodings.
3. Uninstall vulnerable Python packages: In unpatched Python environments, uninstall Brotli and brotlicffi to force clients back to gzip or deflate. For Node.js, no configuration workaround exists, making runtime upgrades mandatory.