A critical flaw within Google’s Brotli decoder has been identified in numerous software platforms, such as Bun, Python’s Brotli and brotlicffi packages, and Envoy proxies configured for Brotli decompression. Designated as CVE-2026-111497, this vulnerability enables attackers to manipulate compressed data to overflow buffers, potentially leading to memory corruption, application crashes, or unauthorized code execution.
Vulnerability Details
Imperva researchers demonstrated that unpatched Node.js builds could execute code through this flaw. However, similar exploits in other software have not been observed, and no real-world attacks have been reported so far. The issue was initially disclosed on October 21, prompting immediate fixes from Node.js and Google, with subsequent updates following suit.
The flaw resides in the C code responsible for unpacking Brotli streams, affecting any software utilizing this code. This includes various language runtimes, proxies, and Python packages, thus necessitating individual updates for each affected program.
Affected Software
Multiple software versions are impacted, each requiring updates to mitigate the flaw. The vulnerable versions include Google Brotli (C library) versions 1.0.3 to 1.2.0, Node.js versions 22.x, 24.x, and 26.x before the fix, and Bun up to version 1.4.3, among others. Updates have been released for these software packages, addressing the vulnerability in their respective latest versions.
Software systems are at risk only if they decode Brotli data controlled externally. For instance, Node.js and Bun become vulnerable when processing responses with ‘Content-Encoding: br’ or when handling Brotli-compressed request bodies. Similarly, Envoy and Istio are affected when Brotli decompression is activated.
Mitigation and Future Outlook
To safeguard against potential exploits, users are advised to update to the fixed versions listed in the advisory. Additionally, disabling Brotli decoding for untrusted data sources is recommended. OpenAI suggests rejecting requests with ‘Content-Encoding: br’ and disabling automatic Brotli decoding in HTTP clients.
As updates are rolled out at varying times across different systems, users should remain vigilant. For instance, Debian has already addressed the issue in its Brotli package for Debian 13, while Amazon Linux is yet to implement fixes as of recent reports. Users are encouraged to verify their installed versions manually, especially in environments where dependency scanners might not yet flag affected Python packages.
The severity of this flaw has garnered varied ratings, with Google marking it as critical under the CVSS 4.0 scale. Despite the lack of in-the-wild exploitation, continuous monitoring and prompt updates remain crucial to preventing potential security breaches.
