Brotli vulnerability affects multiple software ecosystems

Threat summary

Multiple vendors and projects have released updates to address CVE-2026-111497 after researchers demonstrated remote code execution against an unpatched Node.js deployment. Available fixes include:

• Node.js 22.23.4, 24.22.1, and 26.12.1

• Bun 1.4.4

• Python Brotli 1.2.1

• brotlicffi 1.2.1.0

• Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8, and 1.36.12

• Istio 1.31.2, 1.30.6, and 1.29.9

Security updates have also been released for affected .NET and PowerShell deployments.

CVE-2026-111497 affects Google Brotli decoder, a component used to decompress Brotli-compressed data. Brotli is a widely used compression format designed to reduce the size of web traffic and application data. Many applications, frameworks, proxies, and runtimes rely on the decoder to process compressed content received from users, external services, or other systems.

The vulnerable functionality is intended to safely reconstruct original data from compressed input. CVE-2026-111497 is an out-of-bounds write vulnerability that can be triggered by specially crafted Brotli data.

The associated CVE identifies both an out-of-bounds write (CWE-787) and an unchecked return value (CWE-252). Under specific conditions, malformed data can cause memory corruption during decompression. Confirmed impacts include application crashes, information disclosure, and the potential for arbitrary code execution.

Exploitation is remote and does not require authentication or user interaction. However, a threat actor must be able to deliver malicious Brotli-compressed content to a vulnerable decoder. Researchers demonstrated this through applications retrieving Brotli-compressed responses from external systems and applications configured to process Brotli-compressed request bodies. Exposure therefore depends heavily on application design, deployment architecture, and configuration.

Public GitHub repositories appeared within hours of the Node.js security release on October 21, 2026, and subsequent research focused on demonstrating code execution against vulnerable Node.js deployments. Researchers later expanded analysis to other products that incorporate the vulnerable Brotli decoder.

Researchers were able to achieve remote code execution against an official Node.js 24.22.0 Linux arm64 environment using both inbound request processing and outbound content retrieval paths. The demonstration did not succeed consistently across all attempts.

Severity ratings differ across affected vendors:

• Google assigned the underlying Brotli vulnerability a Common Vulnerability Scoring System (CVSS) v4 score of 9.2

• Node.js classifies the issue as High severity

• Microsoft rates the associated .NET issue as an elevation of privilege vulnerability with a CVSS v3.1 score of 8.1 and assesses exploitation as more likely.

Analysis

Organizations are most likely to be affected by this flaw when internet-facing applications, APIs, proxies, gateways, or middleware decompress Brotli-compressed data received from external sources. Exposure depends on whether attacker-controlled data can reach the vulnerable decoder rather than the use of a particular language, framework, or product.

The vulnerability is notable because the affected decoder is often embedded within application dependencies rather than directly visible to administrators. An organization may not intentionally use Brotli while still relying on vulnerable code through application frameworks, middleware, HTTP clients, reverse proxies, service meshes, or language runtimes. Exposure assessment may therefore require both dependency review and software inventory validation.

Exposure would vary between products. Some software automatically decompresses Brotli content during normal operation, while other products require explicit configuration before vulnerable code paths become reachable. Envoy and Istio deployments are only exposed when Brotli decompression functionality is enabled, and affected .NET deployments require Brotli decompression features or APIs to process untrusted data. A bare Node.js HTTP server does not automatically decompress incoming Brotli request bodies simply by receiving them.

The confirmed impact is memory corruption that can lead to service instability, information disclosure, or arbitrary code execution. Real-world impact depends on the privileges of the affected process and the role of the compromised system. Applications that retrieve data from external APIs or web services, decompress Brotli-compressed request or response traffic, or process Brotli-compressed content from external sources are more likely to expose the vulnerable decoder to attacker-controlled data.

Successful code execution against an exposed application server could enable malware deployment, credential theft, unauthorized access to application data, proxy abuse, or movement into connected systems.

Mitigations

Update to a fixed release where available:

• Google Brotli: 1.0.10, 1.1.1, or 1.2.1
• Node.js: 22.23.4, 24.22.1, or 26.12.1
• Bun: 1.4.4
• Python Brotli: 1.2.1
• brotlicffi: 1.2.1.0
• .NET: 8.0.33, 9.0.22, 10.0.14, or 11.0 RC3
• Envoy: 1.40.0, 1.39.3, 1.38.6, 1.37.8, or 1.36.12
• Istio: 1.31.2, 1.30.6, or 1.29.9
• PowerShell: apply the security update referenced in Microsoft's advisory.

Migrate unsupported software to a supported release. Node.js 20.x and other end-of-life release lines do not receive fixes for this vulnerability. Istio 1.29.9 contains the fix, but the 1.29 release line reached end of life on October 15, 2026, making migration to a supported branch the longer-term remediation path.

Where updates are not yet available through operating system repositories, verify whether the affected application uses the operating system's Brotli package or a bundled Brotli decoder. Some products, including official Node.js and Bun builds, bundle their own Brotli implementation. Updating the operating system Brotli package alone may not remediate those deployments.

Where patching is delayed, review whether Brotli decompression is enabled for inbound requests or outbound responses. In affected Envoy and Istio deployments, disabling Brotli decompression functionality can prevent vulnerable code paths from processing attacker-controlled content until updates are deployed. Review downstream services before making configuration changes because compressed traffic may continue to components that also perform decompression.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up