Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.

Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially causing a crash, a memory leak, or the execution of attacker-controlled code.

Imperva researchers have shown that code can run on one unpatched Node.js build. The same has not been demonstrated on the other software, and no real-world attacks have been reported.

The flaw was first disclosed on October 21, when Node.js and Google shipped fixes, and more have followed product by product since. Because the bug is in Google's decoder and each program ships its own copy of it, every one has to update that copy on its own.

Brotli is a compression format from Google, used across the web to shrink pages and other traffic. The bug is in the C code that unpacks a Brotli stream, so it travels into anything that reuses that code, from language runtimes to proxies to Python packages.

Which Software Is Affected

A program is exposed only if it decodes Brotli data that someone else controls. For Node.js and Bun, that happens when the built-in fetch() reads a response sent with Content-Encoding: br, or when request-body code such as Express 5 and body-parser 2 unpacks a Brotli upload. A plain Node.js HTTP server does not decode request bodies on its own.

Envoy and Istio are affected only when Brotli decompression is enabled, for example, through an Envoy filter. Where it is off, the flaw cannot be reached.

In Python, the risk comes from the Brotli or brotlicffi package being installed at all. Once either is present, HTTP clients such as requests, urllib3, httpx, and aiohttp decode Brotli responses on their own, so an application can be exposed without ever importing Brotli in its own code.

A web application firewall helps only so far. Vercel, which added firewall rules on the day of disclosure, said those rules do not cover "responses your functions fetch from other servers." For that path, only updating the runtime or library closes the hole.

How far the flaw can be pushed depends on the software. Imperva's Red Team, which calls its work Node2Shell, ran attacker-supplied code on an unmodified Node.js 24.22.0 build for Linux on ARM64, delivering it both as a fetched response and as an Express request body. The exploit took several tries, has not been released, and was not tested on other builds.

OpenAI, whose Codex Security team reported the flaw, describes it as enabling unauthenticated remote code execution in Brotli and lists Node.js, Bun, and Envoy as affected software. In its account, the flaw works both ways:

an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as "curl --compressed") could be taken over by a malicious server.

No in-the-wild exploitation has been reported. CISA's October 23 assessment recorded exploitation as "none" and automation as "no," and Red Hat said there is no reliable public proof-of-concept for running code.

Severity ratings differ by who is scoring. Google, which assigned the CVE, rates it 9.2, or critical, on the CVSS 4.0 scale. Node.js calls it high, and Red Hat rates it 8.1, or important. Microsoft scores it 8.1, or high, for .NET.

The fix has an unusual history. The change that closes the flaw was added to Brotli's source code on February 27, but no new Brotli release carried it until October 21. OpenAI said the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli."

Node.js credits Khai Tran and Sylvie Mayer of OpenAI's Codex Security for reporting the flaw, and maintainers Matteo Collina and Antoine du Hamel for the fix.

What to Do Now

Update to a fixed version from the table above, then restart the service and rebuild any container image, because a running process keeps the old decoder until it restarts.

Where you cannot update yet, stop decoding untrusted Brotli. OpenAI's disclosure page and the security firm Aikido both recommend:

• Reject incoming requests with Content-Encoding: br before any proxy or parser decodes the body.
• Turn off automatic Brotli decoding in HTTP clients, and reject Brotli responses before they are decoded.
• In Python, uninstall the Brotli and brotlicffi packages so clients fall back to gzip and deflate.

Dropping br from the Accept-Encoding header does not help on its own, because a server can send Brotli whatever the client asks for. For Node.js, no workaround has been published, so updating the runtime is the only fix.

System packages are being fixed at different times. Debian fixed its brotli package for Debian 13 (trixie) on October 23 in version 1.1.0-2+deb13u1, and has since fixed Debian 12 (bookworm) in version 1.0.9-2+deb12u1. Amazon Linux 2023, which listed its brotli and Node.js 24 packages as pending a fix on October 22, shipped fixed versions of both on October 24. openSUSE Tumbleweed has fixed brotli and Node.js 24 packages, while SUSE's Node.js 22 updates for SUSE Linux Enterprise 15 were still in testing as of October 26. Ubuntu still listed its brotli and nodejs packages as needing evaluation on all its listed releases.

Dependency scanners may not flag the Python packages yet. The CVE record names Google's Brotli repository, not the PyPI packages, and GitHub's advisory still lists no affected package, which is what Dependabot reads. Advisory entries for the two Python packages, PYSEC-2026-4322 and PYSEC-2026-4323, were added on October 23, so check the installed versions manually as well.

Update: Microsoft Patches .NET as More Fixes Arrive

Microsoft released out-of-band updates on October 25 that fix the flaw in .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. The fixed runtimes are 8.0.33, 9.0.22, and 10.0.14, and Microsoft's advisory says .NET Framework is not affected.

A .NET app is exposed only if it decodes Brotli data an attacker controls. That happens when it turns on Brotli in ASP.NET Core request decompression or in HttpClient automatic response decompression, neither of which is on by default, or when it passes untrusted data to Brotli APIs such as BrotliStream and BrotliDecoder. Microsoft says having an affected package installed does not by itself expose an app.

Microsoft says the bug lets an unauthenticated attacker read or corrupt process memory, which could lead to information disclosure, denial of service, or elevation of privilege. Its advisory does not list remote code execution among the outcomes.

Installing the updated runtime and restarting is enough for apps that use the shared runtime. Self-contained apps must be rebuilt and republished, and so must NativeAOT apps, because the decoder is linked into the executable. Container images need to be rebuilt from the updated .NET images.

Where an app cannot be updated yet, Microsoft advises removing the br provider from an existing request decompression setup and dropping DecompressionMethods.Brotli from an existing HttpClient handler. It warns against adding decompression to an app that does not already use it, because that can create new denial-of-service risks.

The same release also fixes CVE-2026-114148, an unrelated flaw in which incorrect file ownership in some Linux .NET tarballs could let a local attacker gain higher privileges.

The brotli gem for Ruby fixed the flaw in version 0.9.1 on October 24. It bundles Brotli 1.2.1 and ignores a system Brotli library that lacks the fix, using its own copy instead.

Cloudflare added two rules for the flaw to its managed firewall ruleset on October 25, including one that matches incoming requests sent with Content-Encoding: br. Both only log matching traffic by default and block nothing unless a customer changes their action.

Update: JFrog Finds the Flaw in FFmpeg, ClickHouse, and Apache Arrow

Researchers at JFrog reported on October 25 that the flaw also reaches FFmpeg, ClickHouse, and Apache Arrow, and that some of these paths start with a file rather than a web request. Rejecting Content-Encoding: br at the network edge does not cover those file paths.

In FFmpeg, the path runs through libjxl, the JPEG XL image library, which uses Brotli to unpack compressed metadata inside a JPEG XL file. A crafted image let JFrog take control of the program's instruction pointer, which decides what code runs next, though JFrog said turning that into code execution would take more work. JFrog did not report a fix specific to FFmpeg. The flaw sits in the Brotli library that libjxl uses, so a patched copy of that library closes this path.

ClickHouse, the open-source database, decodes Brotli in HTTP request bodies sent with Content-Encoding: br, in .br files, and in Parquet data, according to the pull request that fixes it. JFrog crashed a ClickHouse server with a single crafted request of about 23 MB, a denial of service, and did not claim code execution. JFrog said no patched release had shipped when it published, and a backport moving ClickHouse's bundled Brotli to 1.2.1 was merged into the 26.9 branch on October 26.

Apache Arrow's C++ library bundles Brotli 1.0.9 for its own builds, according to an open issue in the project's tracker, which had no linked fix or maintainer reply as of October 26. The issue says reading a Parquet or Arrow IPC file with Brotli-compressed data can reach the bug, and that builds linking a patched system Brotli are not affected. In pyarrow, the Python package, JFrog found that a 534-byte input sent Brotli decompression into an endless loop that kept the CPU busy, a denial of service rather than a crash.

JFrog also crashed a .NET test program through its Brotli APIs, the path Microsoft's October 25 updates fix.

(The story was updated after publication on October 26, to include Microsoft's .NET fixes, JFrog's research on other affected software, the Ruby gem fix, Cloudflare's firewall rules, and new Linux distribution packages.)