The CVE-2026-111497 vulnerability in Google’s Brotli compression decoder allows a buffer overflow write when processing specially crafted compressed data. Since a wide range of software products — from Node.js and Bun to Python packages and Envoy proxies — ship their own copy of this decoder, the impact surface turned out to be significant. Researchers from Imperva have demonstrated arbitrary code execution on an unmodified Node.js 24.22.0 build for Linux arm64. Patches are already available: updating the runtime or library is the only reliable way to remediate.
Technical core of the vulnerability
The vulnerability is classified as CWE-787 (out-of-bounds write) and resides in the C code of the Brotli decoder. According to the entry in the GitHub Advisory Database, the problem occurs when processing a Brotli stream whose declared block structure leads to an impossible block type transition. The vulnerable decoder interprets this state as a request for additional data and continues operating in an invalid state, which results in a write beyond the allocated buffer. The fixed version instead stops decoding with a format error.
Severity ratings differ depending on the product context. The GitHub Advisory Database lists 9.2 Critical under CVSS v4.0. Red Hat rates the vulnerability as Important with a score of 8.1 under CVSS v3.1. Node.js assigns a High rating. Istio specifies 7.7 in the context of its product. This spread reflects the different conditions under which the vulnerable code is reachable in each product, and none of these ratings should be taken as universal.
The patch history is notable: the fix that addresses the root cause was added to the Brotli source code as early as February 27, but at that time it was not known that the change eliminated a security vulnerability, and no new Brotli release including this fix was made until October 21. Details are available on the NVD page.
Affected products and exploitation conditions
A key characteristic of this vulnerability is that each affected product ships its own copy of the Brotli decoder, so each one must be updated independently. The confirmed list of affected software:
- Node.js — 22.x, 24.x, and 26.x branches. Fixed versions: 22.23.4, 24.22.1, and 26.12.1 (Node.js advisory)
- Bun — versions from 1.0.21 to 1.4.3. Fixed in 1.4.4 (Bun advisory)
- Python Brotli package (PyPI) — versions from 1.0.3 to 1.2.0. Fixed in 1.2.1
- Python brotlicffi package (PyPI) — similarly affected
- Envoy — when Brotli decompression is enabled (Envoy advisory)
- Istio — versions 1.29.0–1.29.8, 1.30.0–1.30.5, 1.31.0–1.31.1 when the affected Envoy path is used
Exploitation conditions depend on configuration. A program is vulnerable only if it decodes Brotli data from an untrusted source. For Node.js and Bun this occurs when reading a response with the Content-Encoding: br header via the built-in fetch(), as well as when decompressing a request body via middleware. The Node.js HTTP server by itself does not decode Brotli-formatted request bodies — this requires an explicit call or middleware. According to the Express 5 documentation, the express.json(), express.urlencoded(), express.text(), and express.raw() middleware now support Brotli decompression, which creates an inbound attack vector on routes where these handlers are active.
The situation in Python is particularly insidious: simply having the Brotli or brotlicffi package installed is enough for the HTTP clients requests, urllib3, httpx, and aiohttp to start automatically decoding Brotli responses — without explicitly importing Brotli in the application code.
For Envoy and Istio, the vulnerability is reachable only when Brotli decompression is enabled through the relevant filter.
Exploitation status and demonstration
The exploitation status is: public PoC available. As part of the Node2Shell demonstration, Imperva researchers achieved arbitrary code execution on a standard Node.js 24.22.0 build for Linux arm64, without a debugger and without a modified build. The exploit was reproducible via both vectors — the inbound request body (Express 5) and a response received via fetch(). However, exploitation was not stable and required several attempts; other architectures and the 22.x and 26.x branches were not tested.
According to the Vercel advisory, researchers also demonstrated process memory leakage and command execution on unpatched Node.js branches. As of the publication date, no exploitation in real-world attacks has been observed. The vulnerability is not listed in the CISA KEV catalog.
Limitations of WAF protection
Vercel deployed WAF rules on October 21 to block inbound attacks. However, as explicitly stated in the Vercel advisory, these rules do not cover Brotli-formatted responses that the application receives from external servers. This is a fundamental limitation: WAF telemetry can detect some attack attempts in inbound traffic, but it cannot protect against malicious responses received by the application when it accesses external resources. Therefore, runtime inventory and container image rebuilds remain mandatory.
Recommendations
Update priority should be given to internet-exposed services and clients that automatically decode untrusted Brotli data. The mere fact of receiving HTTP traffic does not mean Node.js is vulnerable — there must be code or middleware performing decompression.
- Update your runtime or library to a fixed version. After updating, restart the service and rebuild container images — the running process continues using the old decoder until it is restarted.
- Node.js 20.x and older branches will not receive a fix — migration to a supported branch is required.
- If immediate updating is impossible: reject inbound requests with the
Content-Encoding: brheader before a proxy or parser starts decompression; disable automatic Brotli decompression in HTTP clients. - In Python: remove the Brotli and brotlicffi packages so that clients fall back to gzip and deflate.
- Check your dependency scanners: the CVE entry references the Google Brotli repository rather than the PyPI packages, and the GitHub Advisory at publication time did not list the affected package — Dependabot may not trigger. PYSEC-2026-4322 and PYSEC-2026-4323 entries were added on October 23; verify installed versions manually.
Removing br from Accept-Encoding by itself does not provide protection: a server can send a Brotli-formatted response regardless of the client’s preferences. For Node.js, no workaround within the runtime has been published — updating is the only way to eliminate the vulnerability.
Update all instances of affected runtimes and libraries, giving top priority to services that process untrusted Brotli traffic in both directions — both inbound and when receiving responses from external servers. Previously we covered security fixes in Google products — CVE-2026-111497 confirms that Google components embedded in third-party products require separate tracking and updating.
