Brotli Decoder Flaw Enables RCE Across Node.js, Bun, Python, and Envoy

A critical memory-corruption vulnerability in Google’s C Brotli decompression library exposes a massive ecosystem of modern server runtimes, edge proxies, and application frameworks to remote code execution and denial-of-service risks. Tracked as CVE-2026-111497, the Brotli decoder flaw stems from an out-of-bounds write condition that allows a specially crafted compressed data stream to overwrite memory beyond the boundary of an allocated buffer.

Because Google’s reference C implementation of Brotli is widely compiled directly into core programming language runtimes, client libraries, and service meshes, the weakness has propagated quietly across software supply chains. Fixes began rolling out on October 21, but enterprise remediation remains complex due to varying downstream release schedules and widespread container image caching.

Silent Fixes and Supply Chain Propagation

The vulnerability traces its origin to Google’s core Brotli repository. Under specific decompression states, the C decoder fails to properly validate incoming stream dimensions, leading to unhandled buffer boundaries (categorized under CWE-787 for out-of-bounds writes and CWE-252 for unchecked return values).

Ironically, the code modification that addresses this vulnerability was pushed to the Brotli upstream repository on February 27. However, because the underlying commit was not identified as a security issue at the time, no formal release version or security advisory was tagged. Downstream maintainers who vendor upstream Brotli source code remained unaware of the issue for nearly eight months.

The vulnerability was formally brought to light by Khai Tran and Sylvie Mayer of OpenAI’s Codex Security team, who identified the impact on popular application stacks. OpenAI confirmed that the flaw facilitates unauthenticated remote code execution (RCE) in server applications and proxies that decode untrusted Brotli data. Following OpenAI’s disclosure, maintainers including Node.js core contributors Matteo Collina and Antoine du Hamel issued point releases to patch the embedded C code.

Mechanics of Exploitation Across Runtimes

The practical attack surface depends on how an application handles incoming compressed traffic. A system is only exposed if it automatically unpacks Brotli data supplied by an external, untrusted entity.

• Node.js and Bun: Applications using the built-in fetch() API are exposed when reading HTTP responses served with a Content-Encoding: br header. On the server side, standard Node.js HTTP servers do not decode request bodies by default, but popular middleware stacks such as Express 5 and body-parser 2 automatically decompress Brotli-encoded uploads, exposing endpoint handlers to incoming payloads.
• Python Ecosystem: Python applications face a insidious vector. Merely installing the brotli or brotlicffi PyPI packages registers Brotli support globally for common HTTP client libraries, including requests, urllib3, httpx, and aiohttp. Once installed, these clients automatically decompress Brotli responses without requiring any explicit import brotli statement in the application codebase.
• Service Meshes and Proxies: Envoy and Istio are vulnerable when Brotli decompression filters are explicitly enabled. If Brotli filters are turned off, the vulnerable code paths cannot be reached.

Demonstrating the severity of the flaw, Imperva’s Red Team (under the project name Node2Shell) successfully achieved remote code execution on an unmodified Linux ARM64 build of Node.js 24.22.0. The exploit delivered malicious Brotli payloads both as an outbound fetch() response and through an Express body-parser request. While the exploit required multiple execution attempts due to heap layout variances and has not been publicly released, it confirms that memory corruption in the C decoder can be weaponized against modern server runtimes.

Assessing Risk and Scanner Blind Spots

Despite the critical CVSS 4.0 score of 9.2 assigned by Google (and an 8.1 / Important rating by Red Hat), immediate threat intelligence indicates no active exploitation in the wild. As of late October, CISA lists active exploitation as “none” and automation as “no.” FIRST’s Exploit Prediction Scoring System (EPSS) measures the 30-day probability of exploitation at 0.48% (the 40.5th percentile), reflecting the technical complexity of crafting reliable heap-manipulation exploits across heterogeneous compiled targets.

However, security teams face a significant blind spot regarding software composition analysis (SCA). Traditional dependency scanners reading GitHub Security Advisories or Dependabot metadata initially failed to flag the Python brotli and brotlicffi packages because the official CVE record named Google’s core repository rather than the PyPI package wrappers. Although dedicated advisories (PYSEC-2026-4322 and PYSEC-2026-4323) were published on October 23, automated tools may miss vendor-compiled binaries or statically linked language runtimes unless deep binary scanning is employed.

Furthermore, Web Application Firewalls (WAFs) offer incomplete protection. While edge firewalls can intercept inbound HTTP request bodies sent to web servers, Vercel noted that WAF rules cannot inspect or filter Brotli responses fetched asynchronously by backend serverless functions from external third-party endpoints.

Immediate Remediation Steps

Resolving CVE-2026-111497 requires updating the core runtime or language environment and restarting active workloads:

1. Update Language Runtimes & Packages: Upgrade Node.js, Bun, Envoy, and system brotli packages to versions released on or after October 21. For Linux distributions, verify package maintainer tracker status; for instance, Debian 13 (trixie) updated its brotli package to 1.1.0-2+deb13u1 on October 23, while other enterprise distributions remain in pending status.
2. Rebuild Containers and Restart Services: Because running OS processes keep memory handles to older C shared objects or statically linked runtimes, patching host or image dependencies is ineffective until running container pods and application services are fully restarted.
3. Apply Workarounds Where Patching Is Delayed:
   • Python: Uninstall brotli and brotlicffi from Python environments if they are not strictly required. Stripping these packages forces HTTP clients like urllib3 and requests to fall back safely to gzip and deflate.
   • Ingress Edge: Drop or reject incoming requests containing Content-Encoding: br before they reach backend application parsers or reverse proxies.
   • Client Decoupling: Disable automatic Brotli response decompression in HTTP client configurations. Simply stripping Accept-Encoding: br from outgoing request headers is insufficient, as malicious servers can return Brotli-encoded responses regardless of client header preferences.