A Brotli decoder bug sits inside Node.js, Python and Envoy. Update each one, then restart

Brotli is the compression format many websites use to shrink pages. A bug in Google’s Brotli decoder, CVE-2026-111497, lets crafted compressed data write past the end of a buffer, and Google’s Brotli library is copied into Node.js, Bun, Envoy and two Python packages.

Node.js and Google shipped fixes on October 21. Each program carries its own copy of the decoder, so each one needs its own update, and a running service keeps the old code until it restarts.

One bug in Google’s Brotli decoder lives inside Node.js, Bun, Envoy and Python. Each copy needs its own update, and each service needs a restart.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

One Brotli decoder bug, many programs to update

The CVE record says Brotli 1.0.3 through 1.2.0 can let a remote, unauthenticated attacker corrupt decoder memory, leak memory contents, crash the process or possibly run code with a crafted stream. Google rates it 9.2 under CVSS 4.0 and fixed it in Brotli 1.0.10, 1.1.1 and 1.2.1. Node.js rates its own copy high and fixed it in 22.23.4, 24.22.1 and 26.12.1.

Imperva’s red team ran its own code on an unmodified Node.js 24.22.0 build for Linux on ARM64, The Hacker News reported, sending the payload as a fetched response and as an Express request body. That exploit has not been released, and no attacks have been reported.

Node.js services, Python HTTP clients and Envoy proxies

A program is exposed when it decodes Brotli data someone else controls. In Node.js and Bun that happens when fetch() reads a response sent with Content-Encoding: br, or when Express 5 and body-parser 2 unpack a Brotli upload. In Python, simply having the Brotli or brotlicffi package installed is enough, because requests, urllib3, httpx and aiohttp then decode Brotli responses on their own.

Dependency scanners can miss it. The Hacker News notes the CVE names Google’s repository, not the PyPI packages, and the Python advisory entries only appeared on October 23. Envoy and Istio are affected only when Brotli decompression is turned on.

Update Node.js, the Python packages and Envoy, then restart

• Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. Node.js 20 and older are end of life and get no fix.
• In Python environments, run pip show brotli brotlicffi and upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0, or uninstall them so clients fall back to gzip.
• Update Bun to 1.4.4, and Envoy to 1.40.0, 1.39.3, 1.38.6, 1.37.8 or 1.36.12 where its Brotli decompressor is configured.
• Restart services and rebuild container images after updating; a running process keeps the old decoder.
• Where an update has to wait, reject request bodies sent with Content-Encoding: br before a parser decodes them.

Details

• CVE-2026-111497: out-of-bounds write in c/dec/decode.c, CVSS 4.0 9.2 (Google), high (Node.js). Also tracked as GHSA-9v8h-qqgm-4m35, PYSEC-2026-4322 (Brotli) and PYSEC-2026-4323 (brotlicffi).
• Fixed: Google Brotli 1.0.10, 1.1.1, 1.2.1; Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4; Python Brotli 1.2.1; brotlicffi 1.2.1.0; Istio 1.31.2, 1.30.6, 1.29.9.
• Credit: reported to Node.js by Khai Tran and Sylvie Mayer of OpenAI Codex Security.
• Exploitation: none reported; Singapore’s CSA has issued an alert on the Node.js release.

Hunt / verify

• Run node -v on every host and in every image your CI builds, not only on the servers you remember.
• Search lockfiles and images for brotli and brotlicffi; they often arrive as optional extras of HTTP libraries.
• Check Envoy and Istio configs for a Brotli decompressor filter to see whether those proxies are in scope at all.

Source: Node.js October 21, 2026 security releases; OSV: GHSA-9v8h-qqgm-4m35

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases
• OSV: Brotli out-of-bounds write (GHSA-9v8h-qqgm-4m35)
• Google Brotli v1.2.1 release
• The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
• Cyber Security Agency of Singapore: Critical Vulnerability in Node.js
• CVE.org: CVE-2026-111497

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].