CYBUNKR

Brotli flaw:what to update

Published

A flaw in Google's Brotli decoder, CVE-2026-111497, lets crafted compressed data corrupt memory in Node.js, Bun, Python libraries and more. What is affected and what to update.

On 21 October Google released Brotli 1.0.10, 1.1.1 and 1.2.1 to fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Brotli is a compression format used across the web, so its decoder is built into a lot of software. Google's CVE record says a remote attacker without a login could use a crafted Brotli stream to corrupt memory, leak memory contents, crash the program or potentially run their own code. Google rates it 9.2 out of 10 (CVSS v4.0); Node.js rates it high. It was reported by OpenAI's Codex Security team.

What is affected

  • Brotli 1.0.3 to 1.2.0, on all platforms.
  • Node.js 22.x, 24.x and 26.x, which bundle Brotli. The Node.js advisory says any application that decompresses attacker-supplied Brotli data with node:zlib is at risk.
  • Other software: The Hacker News reports it also reaches Bun, the Python brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.

As of 24 October, Imperva researchers have shown code running on one unpatched Node.js build. That hasn't been shown on other software, and no real-world attacks have been reported.

What to do

  • Update Node.js to 22.23.4, 24.22.1 or 26.12.1.
  • Update Brotli to 1.0.10, 1.1.1 or 1.2.1, and update the brotli and brotlicffi Python packages.
  • Rebuild what bundles it: containers and applications with their own copy of Brotli don't get fixed by operating system updates, so rebuild and redeploy them.
  • Check proxies, gateways and vendor products that decompress Brotli, and apply vendor updates as they arrive.
  • If you can't update straight away, avoid decompressing Brotli data from sources you don't trust.

How we can help

Not sure where Brotli or Node.js runs in your estate? Get in touch. Our Penetration Testing finds exposed and unpatched systems.

Sources