A Brotli decoder bug sits inside Node.js, Python and Envoy. Update each one, then restart

By George Bailey   Published: 10/26/26   4 min read
Cyber News

Brotli is the compression format many websites use to shrink pages. A bug in Google’s Brotli decoder, CVE-2026-111497, lets crafted compressed data write past the end of a buffer, and Google’s Brotli library is copied into Node.js, Bun, Envoy and two Python packages.

Node.js and Google shipped fixes on October 21. Each program carries its own copy of the decoder, so each one needs its own update, and a running service keeps the old code until it restarts.

One bug in Google’s Brotli decoder lives inside Node.js, Bun, Envoy and Python. Each copy needs its own update, and each service needs a restart.

One Brotli decoder bug, many programs to update

The CVE record says Brotli 1.0.3 through 1.2.0 can let a remote, unauthenticated attacker corrupt decoder memory, leak memory contents, crash the process or possibly run code with a crafted stream. Google rates it 9.2 under CVSS 4.0 and fixed it in Brotli 1.0.10, 1.1.1 and 1.2.1. Node.js rates its own copy high and fixed it in 22.23.4, 24.22.1 and 26.12.1.

Imperva’s red team ran its own code on an unmodified Node.js 24.22.0 build for Linux on ARM64, The Hacker News reported, sending the payload as a fetched response and as an Express request body. That exploit has not been released, and no attacks have been reported.

Node.js services, Python HTTP clients and Envoy proxies

A program is exposed when it decodes Brotli data someone else controls. In Node.js and Bun that happens when fetch() reads a response sent with Content-Encoding: br, or when Express 5 and body-parser 2 unpack a Brotli upload. In Python, simply having the Brotli or brotlicffi package installed is enough, because requests, urllib3, httpx and aiohttp then decode Brotli responses on their own.

Dependency scanners can miss it. The Hacker News notes the CVE names Google’s repository, not the PyPI packages, and the Python advisory entries only appeared on October 23. Envoy and Istio are affected only when Brotli decompression is turned on.

Update Node.js, the Python packages and Envoy, then restart

Forward this

For our developers and whoever runs our servers: a bug in the Brotli compression code inside Node.js, Python and some proxies can let crafted data corrupt memory. No attacks are reported. Can we update Node.js and the Python Brotli packages this week, then restart the services and rebuild the containers?

Details

Hunt / verify

Source: Node.js October 21, 2026 security releases; OSV: GHSA-9v8h-qqgm-4m35

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].