Brotli decompression bug behind Node.js RCE also hits Bun, Python, and Envoy

A memory-corruption flaw in Google's Brotli decoder, tracked as CVE-2026-111497, affects far more software than just Node.js. Because many programs embed their own copy of Google's Brotli decoding code, the bug travels into Bun, the Python Brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli, among others. Crafted compressed data can overwrite memory past a buffer's end, potentially causing a crash, a leak, or code execution.

Imperva researchers demonstrated actual code execution on an unpatched Node.js build, delivered through fetch() reading a compressed response or through Express/body-parser handling a compressed upload; this hasn't been demonstrated on the other affected software, and no real-world attacks have been reported. Google rates the flaw 9.2 (critical) on CVSS 4.0; Node.js calls it high and Red Hat rates it 8.1. Node.js and Google shipped fixes on October 21, with other affected projects patching in the following days.

The underlying fix was actually added to Brotli's source code back in February 2026, but nobody realized at the time that it addressed a security issue, so no new Brotli release included it until October. Fixes now exist for Node.js, Bun, Envoy, Istio, and the Python Brotli/brotlicffi packages; where updating isn't possible yet, recommended mitigations include rejecting Brotli-encoded requests and turning off automatic Brotli decoding in HTTP clients.

Why it matters

A single vendored decoder bug quietly reaches across runtimes and proxies, so developers need to check every tool that touches Brotli, not just the one that made headlines.

Source: The Hacker News