Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A critical memory-corruption vulnerability in Google’s Brotli decoder affects multiple widely used software products, including Node.js, Bun, Python packages and Envoy proxies. Tracked as CVE-2026-111497, the flaw could allow attackers to corrupt application memory by supplying specially crafted Brotli-compressed data, potentially causing crashes, exposing sensitive information or executing malicious code.

The vulnerability, also known as Node2Shell in research discussing its Node.js exploitation, was disclosed on October 21, 2026. Security updates have since been released for several affected products.

Researchers from Imperva demonstrated remote code execution against an unpatched Node.js 24.22.0 build running Linux on ARM64. Equivalent exploitation has not been demonstrated for every affected product, and the supplied report states that no real-world attacks have been reported.

The issue is particularly important because Brotli is integrated into numerous applications and runtimes. Updating one component does not automatically fix every product that bundles its own copy of the vulnerable decoder.

How CVE-2026-111497 Works

Brotli is a compression algorithm developed by Google to reduce the size of web content and other data transmitted between systems.

The vulnerability lies in the decoder responsible for decompressing Brotli streams. Malformed input can trigger an out-of-bounds write, allowing data to be written beyond the intended buffer boundary and corrupt adjacent memory.

Depending on the affected application and execution conditions, this memory corruption may cause a denial-of-service condition, disclose process memory or potentially enable remote code execution.

An application is not necessarily vulnerable simply because it uses Node.js, Python or a proxy server. Exposure depends on whether the affected decoder processes attacker-controlled Brotli data.

The official Node.js security advisory confirms that the flaw affects the Brotli decoder bundled with Node.js and can have serious consequences when applications decompress malicious input.

Which Products Are Affected?

The following table summarises the affected versions and fixes listed in the supplied report. Administrators should consult each vendor’s advisory for the latest patch information.

Official product advisories:

• Google Brotli releases
• Node.js security releases
• Bun 1.4.4 release
• Envoy security advisory
• Istio security advisory
• Python Brotli advisory
• Python brotlicffi advisory
• cdxgen security advisory

When Are Applications Exposed?

In Node.js and Bun, exposure can occur when an application decompresses an untrusted Brotli response through fetch() or uses functionality that processes Brotli-compressed request bodies.

A basic Node.js HTTP server does not automatically decompress every incoming request body. The risk depends on the application’s middleware, libraries and configuration.

Envoy and Istio deployments are exposed when the affected Brotli decompressor is enabled and processes untrusted input. If the relevant decompression functionality is disabled, that particular attack path is unavailable.

Python applications require additional attention. The Brotli and brotlicffi packages may be used indirectly by HTTP clients that automatically decompress Brotli responses. Consequently, an application could be exposed even if its own source code never explicitly imports either package.

The vulnerability also demonstrates why software composition matters: an application may bundle an affected runtime or decoder without making the dependency immediately obvious to its operators.

How Organisations Should Mitigate the Vulnerability

Organisations should prioritise the following actions:

• Update affected software: Install the appropriate fixed version for each runtime, package, proxy and bundled executable.
• Rebuild container images: Ensure rebuilt images contain patched dependencies rather than retaining an older bundled runtime.
• Restart affected processes: Restart services after patching so that running processes no longer use the vulnerable decoder.
• Review dependency inventories: Check direct and transitive dependencies, including Python packages and standalone binaries.
• Restrict untrusted compressed input: Where patching is temporarily impossible, disable or reject Brotli decompression on relevant input paths when feasible.
• Verify deployment status: Check vendor advisories and distribution-specific package updates instead of assuming that a fix is available everywhere.

The OpenAI disclosure page and Aikido’s technical discussion provide additional information about the vulnerability and mitigation considerations.

Simply removing br from an HTTP client’s Accept-Encoding header is not a reliable standalone defence: a server may still return Brotli-compressed content. Organisations should use supported controls that actually prevent vulnerable decompression, and prioritise applying the relevant security update.

Why This Vulnerability Matters

CVE-2026-111497 illustrates how a defect in a shared open-source library can affect a broad software ecosystem. Because individual projects bundle and release their dependencies separately, remediation requires coordinated action across multiple maintainers and deployment environments.

Severity ratings may differ between vendors because they use different scoring systems and assumptions. Administrators should consider both the vendor’s assessment and the actual exposure of their deployment.

The supplied report states that no in-the-wild exploitation had been reported at the time of writing. Nevertheless, the demonstrated Node.js proof of concept and the potential consequences of memory corruption make timely patching important.

Conclusion

The Brotli decoder vulnerability CVE-2026-111497 affects more than Node.js. Bun, Python packages, Envoy, Istio and other software may also be exposed when they use vulnerable decoder versions and process attacker-controlled compressed data.

Organisations should inventory affected components, install vendor-provided fixes, rebuild and restart services where necessary, and verify that their deployed versions are protected. Where immediate patching is not possible, carefully restricting access to vulnerable decompression paths can reduce exposure while remediation proceeds.

Sources: Node.js security advisory | Google Brotli releases | Envoy advisory | CVE-2026-111497 details