Brotli Decoder Memory Corruption Enables RCE in Node.js, Bun, Python and More

Brotli Decoder RCE in Node.js, Bun, Python and More

CVE-2026-111497 is a memory-corruption flaw in Google’s Brotli decoder that allows crafted compressed data to overwrite past the end of a buffer. The vulnerability can trigger a crash, a memory leak, or the execution of attacker-controlled code when a program unpacks Brotli data from an untrusted source.

Affected Products and Versions

Attack Path

The flaw resides in the C code that implements the Brotli decompression algorithm. When a program receives a Brotli-compressed stream, the decoder allocates a buffer and copies decompressed bytes into it. A malformed stream can cause the decoder to write beyond the buffer’s end, corrupting adjacent memory. If the attacker controls the data that follows the buffer, they can overwrite function pointers or return addresses, leading to arbitrary code execution.

Imperva researchers demonstrated that on an unpatched Node.js build, a crafted br response delivered via fetch() could trigger a shell spawn. The same proof-of-concept has not yet been shown against Bun, Python, Envoy or Istio, and no real-world exploitation has been reported for those products.

Detection and Logging

Defenders should look for anomalous memory corruption events in application logs, such as segmentation faults or stack overflows, occurring after a Brotli decompression call. In Node.js, the node:process module emits uncaughtException events that can surface the crash. In Python, the interpreter may terminate with a Segmentation fault message. Network traffic analysis can reveal unexpected br responses from untrusted origins.

Mitigation Steps

1. Update the Brotli library – Apply the latest release (1.0.10, 1.1.1, or 1.2.1) in all projects that embed the decoder.
2. Upgrade affected runtimes – Node.js 22.23.4, 24.22.1, or 26.12.1; Bun 1.4.4; Python brotli 1.2.1.
3. Disable Brotli for untrusted data – If immediate patching is not possible, configure proxies or application layers to reject or bypass Brotli decoding for external inputs.
4. Implement runtime protection – Enable address space layout randomization (ASLR) and stack canaries on servers that run vulnerable binaries.
5. Monitor for exploitation – Deploy intrusion detection rules that flag memory corruption patterns following Brotli decompression.

Why the Fix Requires Separate Updates

Because the Brotli decoder is shipped as a static library inside each product, the vulnerability exists in every copy of the library. Updating the upstream Brotli source does not automatically patch downstream consumers; each project must rebuild and redeploy its own copy. This fragmentation increases the window of exposure and complicates coordinated patching across ecosystems.

Next Steps for Operators

• Verify the Brotli version in your environment using package managers or binary inspection.
• Apply the latest patches to Node.js, Bun, Python, Envoy, and Istio as listed.
• Re-test application functionality after the update to ensure no regression in Brotli handling.
• Consider disabling Brotli for external traffic until all components are patched.

The vulnerability was first disclosed on October 21, 2026, and patches were released by Google and the affected projects shortly thereafter. Operators should treat the flaw as a high-priority issue due to the potential for remote code execution.

For a broader view of how CVE exploitation can propagate across ecosystems, see the Zero-Day Vulnerability & CVE Exploit Matrix.

Related coverage

• GitLab Integer Overflow RCE Affects All Self-Managed Releases Since 2014
• Microsoft Patch Tuesday 2026: 1,417 Vulnerabilities, Including Exploited Shell Bypass and Exchange RCE

Explore more on this topic

• More brotli coverage