Brotli Decoder Flaw Exposes Multiple Software to Remote Code Execution

"Those rules do not cover 'responses your functions fetch from other servers,'" Vercel warned after adding firewall rules in response to the disclosure.

The bug: CVE-2026-111497 in Google's Brotli decoder

A memory‑corruption flaw in the C implementation of Google's Brotli decoder, tracked as CVE-2026-111497, can let crafted compressed data overwrite past the end of a buffer and corrupt a program's memory. The corruption may cause a crash, a memory leak, or the execution of attacker‑controlled code. Because the vulnerable code is the Brotli C decoder, the bug travels into any program that ships and uses that decoder.

Which software ships the vulnerable decoder and when it's exposed

The flaw appears in any program that decodes Brotli data it does not control. The source lists several affected products and the conditions that make them vulnerable:

• Node.js and Bun: exposure occurs when the built‑in fetch() reads a response with Content‑Encoding: br, or when request‑body code such as Express 5 and body‑parser 2 unpacks a Brotli upload. A plain Node.js HTTP server that does not decode request bodies is not exposed by default.
• Envoy and Istio: affected only when Brotli decompression is enabled—for example, via an Envoy filter. Where decompression is off, the flaw cannot be reached.
• Python: the risk exists whenever the Brotli or brotlicffi package is installed. Once either package is present, HTTP clients such as requests, urllib3, httpx, and aiohttp decode Brotli responses automatically, so an application can be exposed without ever importing Brotli directly.

What researchers and vendors have demonstrated so far

Imperva's Red Team showed that attacker‑supplied code can run on one unpatched Node.js build: an unmodified Node.js 24.22.0 build for Linux on ARM64. The team delivered the exploit both as a fetched response and as an Express request body. Imperva calls that work Node2Shell; the exploit required several tries, has not been released, and was not tested on other builds.

OpenAI's Codex Security reported the flaw and described it as enabling unauthenticated remote code execution in Brotli. OpenAI noted the flaw works both ways: an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (for example via "curl --compressed") could be taken over by a malicious server.

No in‑the‑wild exploitation has been reported. The Cybersecurity and Infrastructure Security Agency (CISA) recorded exploitation as "none" and automation as "no" in its October 23 assessment, and Red Hat stated there is no reliable public proof‑of‑concept for running code.

Severity assessments vary: Google assigned a 9.2 (critical) on CVSS 4.0, Node.js called the issue high, and Red Hat rated it 8.1 (important).

Patches, timeline, and an unusual release history

Google and Node.js shipped fixes on October 21, the day the flaw was disclosed. The remediation has an unusual provenance: the change that closes the flaw was added to Brotli's source code on February 27, but no Brotli release containing that change appeared until October 21. OpenAI said the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli."

Because many programs bundle their own copy of Google's decoder, each product must update its shipped copy individually. Node.js credits Khai Tran and Sylvie Mayer of OpenAI's Codex Security for reporting CVE-2026-111497 and credits maintainers Matteo Collina and Antoine du Hamel for the Node.js fix.

Operational mitigations: patching, restarting, and workarounds

The primary remediation is to update to a fixed version, then restart the service and rebuild container images: a running process retains the old decoder until it restarts. Where immediate updates are not possible, disclosed mitigations include:

• Reject incoming requests with Content‑Encoding: br before any proxy or parser decodes the body.
• Turn off automatic Brotli decoding in HTTP clients and reject Brotli responses before they are decoded.
• For Python applications, uninstall the Brotli and brotlicffi packages so clients fall back to gzip and deflate.

Dropping "br" from the Accept‑Encoding header is not sufficient, because a server can still send Brotli. The source notes that no workaround has been published for Node.js, making runtime updates the only reliable fix for Node.js deployments. Vercel's own mitigation—its firewall rules—does not cover responses fetched by serverless functions, underscoring that network filtering alone may leave some paths exposed.

What this means for security teams, cloud hosts, and Python developers

• Security teams and operators: prioritize updating runtimes and libraries and restart services and container images after patching. Be aware that system packages are being fixed at different times—Debian fixed brotli for Debian 13 (trixie) on October 23 in version 1.1.0-2+deb13u1, while Amazon Linux 2023 still listed its brotli and Node.js 24 packages as pending fixes as of October 22.
• Cloud hosts and edge providers (example: Vercel): firewall rules can block some attack vectors but do not protect responses fetched by customer functions; runtime and library updates remain necessary to close those paths.
• Python developers and maintainers: dependency scanners may not flag affected PyPI packages immediately because the CVE record names Google's Brotli repository rather than the PyPI packages. GitHub's advisory initially listed no affected package, and Dependabot reads that advisory; advisory entries for the two Python packages (PYSEC-2026-4322 and PYSEC-2026-4323) were added on October 23, so teams should check installed versions manually.

The technical danger is concrete but contained: an exploit has been demonstrated on a single Node.js build, and no widespread exploitation is known. The operational reality is less tidy—every product that bundles Brotli must update its copy, and some ecosystems and package trackers lag in surfacing the impact. For now, the surest action is simple and unavoidable: install vendor fixes, restart processes and images, and stop decoding untrusted Brotli until updates are in place.

Original reporting: https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html