Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google's Brotli decoder affects many programs that handle Brotli-compressed data, including Node.js, Bun, Python packages, and Envoy proxies. This vulnerability, known as CVE-2026-111497, allows attackers to craft malicious compressed data that overwrites memory and potentially executes arbitrary code.

The flaw was disclosed on October 21 and has since been patched in various software. Imperva's research demonstrates that Node.js can be exploited on certain builds. While no real-world attacks have been reported, the issue poses a significant security risk. Vulnerable software must update the affected copy of the decoder independently, as each program ships its own version.

Brotli is a widely used compression format, and the flaw exists in the C code that unpacks the Brotli stream. Programs are vulnerable only if they decode Brotli data from untrusted sources. Node.js and Bun are exposed when the built-in fetch() function reads a response with Content-Encoding: br or when request-body code unpacks a Brotli upload.

Envoy and Istio are affected only when Brotli decompression is enabled. In Python, the risk arises from the Brotli or brotlicffi package being installed, as HTTP clients decode Brotli responses automatically. Mitigations include updating affected software and disabling Brotli decompression for untrusted sources. No proof-of-concept exploits have been publicly disclosed, and the severity of the issue varies among different sources.