AI NewsInfrastructureReported
Brotli decoder bug lets a crafted stream run code on Node, Python and Bun
A Brotli decoder flaw lets a crafted compressed response run code on the server. Node.js, Python, Bun, Envoy and Istio all released fixes.
Image: Aikido Security
Why it mattersAny server that decompresses untrusted Brotli data is a target. Patch the runtime, then the Python and Node packages that bundle Brotli.
A server that reads a Brotli-compressed response can be tricked into running code. The flaw sits in Google's Brotli decoder. Node.js, Python, Bun, Envoy, Istio and curl all use it. Aikido Security wrote up the bug on 23 October, after Node.js disclosed CVE-2026-111497 two days before.
The bug is in a function called DecodeBlockTypeAndLength. It returns a plain true or false. False can mean "the stream is broken" or "I need more input", and the caller cannot tell the two apart. A crafted stream that declares one block type then exhausts its length makes the decoder keep accepting bytes. Those bytes overflow an eight-byte internal buffer and corrupt memory next to it. CVSS v4.0 scores the flaw 9.2 out of 10.
What to patch, in what order
Node.js released the fix on 21 October in versions 22.23.4, 24.22.1 and 26.12.1. The Node.js advisory names the bug a high-severity remote code execution path through node:zlib. Python released its fix on 22 October: Brotli 1.2.1 and brotlicffi 1.2.1.0. Bun released 1.4.4. Envoy fixed it in 1.40.0, 1.39.3, 1.38.6 and 1.37.8. Istio fixed it in 1.29.9, 1.30.6 and 1.31.2. The upstream Brotli fix is tagged 1.0.10, 1.1.1 and 1.2.1.
Patch the runtime first. That is what most servers use when they decompress a response with Accept-Encoding: br. Then update any Python package that bundles its own Brotli build. The urllib3 extra and the aiohttp extra both pull in the broken decoder. Aikido counts 82.8 million downloads a month for the Python Brotli package on PyPI.
Who found it, and who missed it
OpenAI's Codex Security team found the bug in February 2026. The Node.js advisory names the two researchers: Khai Tran and Sylvie Mayer. The patch was then coordinated privately for eight months before the public disclosure. Aikido Security says it only noticed the bug this week, when the Node.js advisory went out. It ran its own test with a 23 megabyte crafted stream. Brotli 1.2.0 kept asking for more input. Brotli 1.2.1 rejected the stream with the new error code.
The lesson for teams building AI products is the small one. A model that reads a web page or calls a tool over HTTP is a client that decompresses the response. The agent runs on a server. If that server uses an unpatched Node.js, Python or Bun, a page the agent fetched can take over the host. The patch is the fix. The audit is to check which workers, agents and gateways still run the old version.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
