Skip to content
Hacker Posts

Brotli decoder RCE (CVE-2026-111497) spans Bun, Python, Envoy

CVE-2026-111497, the Brotli decoder RCE flagged in Node.js, is really a bug in Google's Brotli C library — Bun, Python's bindings, Envoy, Istio and cdxgen each ship a vulnerable copy.

Published 3 min read
cvebrotlircesupply-chain

The Brotli decoder RCE that surfaced last week as a Node.js bug is not a Node.js bug. CVE-2026-111497 is an out-of-bounds write in Google's Brotli reference decoder — the C code that unpacks Brotli streams — and the upstream fix shipped on October 21 in library releases 1.0.10, 1.1.1 and 1.2.1, each carrying the same note: "out-of-bounds write permits remote code execution." Every project that bundles its own copy of that decoder is exposed, and each one patches on its own schedule. If you shipped our Node.js write-up to your team and stopped there, you missed most of the blast radius.

What's affected

Per The Hacker News's roundup, the vulnerable decoder is vendored across a wide spread of widely deployed software. Confirmed affected and fixed:

  • Google Brotli (C library): 1.0.3 through 1.2.0 → fixed in 1.0.10, 1.1.1, 1.2.1.
  • Bun: 1.4.3 and earlier → fixed in 1.4.4.
  • Python Brotli: 1.2.0 and earlier → fixed in 1.2.1. brotlicffi: 1.2.0.x and earlier → fixed in 1.2.1.0.
  • cdxgen: 13.4.0, 12.8.8 and earlier → fixed in 13.5.0, 12.8.9.
  • Envoy and Istio: patched in their latest point releases, but only when the Brotli decompressor is actually configured. Check the vendor advisories for the exact matrix before you assume you're exposed.
  • Node.js: 22.x, 24.x, 26.x → fixed in 22.23.4, 24.22.1, 26.12.1. Lines 20.x and earlier are end of life and get no fix.

The common thread: a crafted Brotli stream reaches a decoder on an untrusted path. The highest-risk surface is any code that decompresses attacker-influenced content-encoding: br data — outbound fetch() responses, request-body middleware, or a proxy configured to inflate Brotli.

Exploitation status

No in-the-wild exploitation has been reported. The only working code execution is Imperva's Node2Shell proof of concept, demonstrated against an unmodified Node.js 24.22.0 Linux arm64 build and not reproduced on Bun, Python, Envoy or any other affected software. Red Hat says there is no reliable public PoC for code execution and rates the issue 8.1; Google assigned the CVE and scores it 9.2 (critical) on CVSS 4.0. Treat the critical rating as the reason to patch now, not as evidence of active attacks.

Action checklist

  1. Inventory every runtime that vendors Brotli, not just Node.js. If you run Bun, decompress Brotli in Python (Brotli/brotlicffi), or terminate traffic through Envoy or Istio with Brotli decompression enabled, you are in scope.
  2. Upgrade to the fixed releases above. There is no in-runtime workaround; the fix is the patched decoder.
  3. Pin the system Brotli library too. Anything dynamically linked against libbrotli needs the distro package bumped to 1.0.10 / 1.1.1 / 1.2.1 or later — a runtime upgrade alone won't cover it.
  4. Where upgrades lag, strip or reject untrusted content-encoding: br on exposed ingress paths as an interim control.

Context

The timeline is the uncomfortable part. OpenAI's Codex Security team (credited as Khai Tran and Sylvie Mayer) reported the flaw, and the fix was committed to Brotli's source on February 27 — but no tagged release carried it until October 21. OpenAI has said the root cause was fixed in February without anyone realizing it was a security issue, which means the window between silent fix and coordinated disclosure ran roughly eight months.

This is the recurring hazard of a reference implementation written in C and copied into dozens of downstreams: the upstream repository can be "fixed" while every vendored copy stays vulnerable until its maintainers cut a new release and consumers rebuild. One decoder, many release trains, one CVE — and the patch is only as good as your inventory of who bundled it.

Related stories