Brotli decoder bug puts Node.js, Bun, Python and Envoy apps at risk

A single flaw in shared compression code has pushed developers to patch several popular tools at once. The Node.js project has patched CVE-2026-111497, a high-severity write past the end of a buffer inside its bundled Brotli decoder. The project's advisory names crashes, memory disclosure and remote code execution as outcomes of the flaw.

The problem reaches well past Node.js. The flaw sits in Google's Brotli C library from version 1.0.3 up to 1.2.0, and since each program bundles its own decoder, every affected project must patch its own copy.

Key facts

• The Node.js team put out security releases for the 26.x, 24.x and 22.x lines on Wednesday, October 21, 2026.
• The fixed Node.js builds are v22.23.4, v24.22.1 and v26.12.1.
• Upstream, the repair landed in Brotli 1.0.10, 1.1.1 and 1.2.1.
• Bun users need version 1.4.4, since 1.4.3 and older carry the bug.
• So far, nobody has reported attacks using the flaw, and a CISA review dated October 23 marked exploitation as none.

How the bug works

Brotli is a widely used way to squeeze web data. Google designed the format, and the faulty piece is the C code that unpacks it, which is why the bug travels into runtimes, proxies and Python libraries.

The mistake itself is small. According to the Node.js project, a bad block switch was handled as if the decoder simply needed more data, so it kept piling bytes into an internal buffer only eight bytes long. Overrunning a buffer in this way is what makes the bug serious.

The attack has been shown to work in at least one setup. Imperva's Red Team got its own code to run on a stock Node.js 24.22.0 build for ARM64 Linux, though the team has kept its exploit private. Whether other builds can be attacked the same way is not known.

The repair took a long time to ship. The patch entered Brotli's source code on February 27, yet no Brotli release included it before October 21.

The Node.js project thanked the finders. It named Khai Tran and Sylvie Mayer of OpenAI Codex Security as the people who reported the flaw.

Severity ratings vary. Google gives the bug a critical 9.2 under CVSS 4.0, Node.js labels it high, and Red Hat puts it at 8.1.

Who is affected

The exposure depends on how an app handles data. Node.js and Bun apps face risk when the built-in fetch() reads a reply marked Content-Encoding: br, or when Express 5 or body-parser 2 decodes an uploaded Brotli body. By contrast, a bare Node.js HTTP server leaves request bodies undecoded.

Envoy is at risk only in some setups. The proxy's releases 1.39.2, 1.38.5, 1.37.7 and 1.36.11 are exposed only with the Brotli decompressor switched on, and 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12 fix it.

Istio follows the same pattern. Its 1.31.0 to 1.31.1, 1.30.0 to 1.30.5 and 1.29.0 to 1.29.8 builds are exposed only with Brotli decompression enabled, and 1.31.2, 1.30.6 and 1.29.9 close the gap.

Python users may be exposed without knowing it. The fix arrived in the Brotli package at 1.2.1 and brotlicffi at 1.2.1.0, and popular clients like requests, urllib3, httpx and aiohttp start unpacking Brotli on their own once either one is present.

What it means for you

One update may not cover everything. Because every project carries its own decoder and must patch it separately, a team that fixes Node.js could still run an old copy inside Bun, a proxy or a Python library.

Edge protection may leave a gap too. One edge provider said its firewall rules do not cover "responses your functions fetch from other servers."

Old Node.js lines are left out. The project says releases past end of life count as affected whenever a security update ships, and only the 26.x, 24.x and 22.x lines received fixes.

Practical steps

• Start with Node.js. The project's security release page links to v22.23.4, v24.22.1 and v26.12.1.
• Restart after patching. A process that is still running holds on to the old decoder, so services need a restart and container images need a rebuild.
• Check Python versions yourself. PYSEC-2026-4322 and PYSEC-2026-4323 only appeared on October 23, so scanners may not flag the packages yet.
• Use a stopgap if patching must wait. One option is to refuse incoming requests marked Content-Encoding: br before decoding; in Python, removing Brotli and brotlicffi makes clients fall back to gzip and deflate.
• Do not count on request headers alone. Leaving br out of Accept-Encoding is not enough, because a server can reply in Brotli regardless.

What happens next

Operating system fixes are rolling out unevenly. Debian patched its brotli package for Debian 13 on October 23, while Amazon Linux 2023 still showed brotli and Node.js 24 as waiting for a fix as of October 22.

It is also unclear whether code execution is possible on builds beyond the one Imperva tested.

FAQ

Will my older Node.js version get a fix? No. Only the 26.x, 24.x and 22.x lines received updates, and end-of-life lines count as affected.

Will my dependency scanner catch the Python packages? Maybe not yet. The PYSEC-2026-4322 and PYSEC-2026-4323 entries were added on October 23.

Does removing br from Accept-Encoding protect me? Not by itself, since a server may send Brotli no matter what the client requests.

Has anyone been attacked with this bug? No in-the-wild attacks have been reported.

Which Bun version is safe? Bun 1.4.4 includes the fix.