Brotli decoder bug CVE-2026-111497 hits Node.js, Python and more: Reveneau

Why it mattersAny app that decodes Brotli from the network is exposed. HTTP clients turn it on by default, so a webhook or a link preview can be the trigger.

A bug in Google's Brotli decoder lets crafted compressed data write past the end of a buffer. The result can be a crash, a memory leak or remote code execution. GitHub rates it 9.2 Critical. The flaw is tracked as CVE-2026-111497 and GHSA-9v8h-qqgm-4m35, and the disclosure page at broccoli2shell.com went up this week.

Fixed Brotli versions are 1.0.10, 1.1.1 and 1.2.1. Node.js released 22.23.4, 24.22.1 and 26.12.1 on 21 October. Node.js 20, 23 and 25 are end of life and will not get a fix. On PyPI, Brotli 1.2.1 and brotlicffi 1.2.1.0 carry the fix.

Who the bug reaches

The disclosure page lists three ways a service runs the vulnerable decoder. The first is an HTTP client that decodes a Brotli response. Node's built-in fetch does this on its own. In Python, requests and urllib3, aiohttp and httpx[brotli] all decode Brotli as soon as a Brotli package is installed. Any server a client talks to can send the payload, through webhooks, link previews or an import-from-URL feature.

The second is a server that accepts a Brotli request body. Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 decode Brotli in their raw and json parsers. The third is any call to zlib.brotliDecompress, createBrotliDecompress, brotli.decompress and any library built on them.

Why an upgrade is not the whole fix

The disclosure page is clear that installing the update is not enough. A running process keeps the old decoder in memory until it restarts. A container image keeps it until you rebuild on a patched base image and redeploy. Lockfile pins have to move to the new versions, or the next build pulls the vulnerable one back in.

For Python the risk is wider than a direct import. If Brotli or brotlicffi is installed, every HTTP client in the process starts decoding Brotli replies. The application never has to ask for it. The author warns that pip-audit, Dependabot and Safety did not reliably flag the affected PyPI versions at disclosure. The CVE record named the upstream Google repository, not the Python packages.

Projects that still ship the broken decoder

The page lists projects that still bundled the affected decoder at the time of writing. DuckDB, Apache Arrow and v8-jsi are named, along with 7-Zip-zstd, p7zip, EDK II firmware and the Makefile build of woff2. The system Brotli package carries the fix once a distribution releases it. Dynamically linked programs pick it up on restart.

Rust's brotli-decompressor catches the condition and returns an error. The Go port had the same logic error but would have crashed, and was fixed on 23 October. Pure Java, JavaScript and C# ports cannot reach the bug. Code execution is only possible in the C decoder.

Who found it and when

The Node.js release landed on 21 October. NVD published the CVE on 22 October, together with a public proof of concept. OpenAI Codex Security reported the bug to Node.js. Matteo Collina and Antoine du Hamel wrote the fix. Imperva Red Team's Ron Masas did the exploitation research. He ran attacker code on an official, unmodified Node.js 24.22.0 Linux arm64 image. The team has not released that exploit.

The public proof of concept reportedly reaches code execution only on a deliberately weakened build. On a standard build it crashes and leaks a limited amount of memory. The page says no attacks in the wild had been reported at the time of writing. Public PoCs change that.

Source

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.