Brotli decoder flaw spreads beyond Node.js to Python and more

Overview

Updated 1 hour ago

A memory-corruption bug in Google's Brotli compression decoder is turning attacker-controlled HTTP traffic into remote code execution across a dozen ecosystems, including many Python setups. Security firm Imperva demonstrated code execution on an unmodified Node.js build, and researchers traced the same flaw through Python's brotli and brotlicffi packages.

The flaw, tracked as CVE-2026-111497 and rated 9.8 out of 10, lets anyone who controls a Brotli-compressed stream corrupt the memory of any program that decompresses it. Because Python HTTP clients auto-decode Brotli responses whenever the package is installed, fetching a malicious URL can be enough to be exposed — and some bundled copies of the decoder have no fix yet.

Why it matters

Any program that decodes Brotli from untrusted input can be remotely taken over, and not all affected software has a fix yet.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

9.8

CVSS severity score

Rated critical by Singapore's Cybersecurity Agency and the NVD for remote unauthenticated exploitation.

Affected software families

Node.js, Bun, Envoy, Istio, Python's brotli and brotlicffi packages, pyarrow, Pillow, cdxgen, and more.

Confirmed in-the-wild exploits

CISA's October 23 assessment recorded exploitation as none and no reliable public proof-of-concept for code execution.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Organizations Involved

Google Brotli Team

Open-source library maintainer

Shipped patched releases 1.0.10, 1.1.1, and 1.2.1 on October 21

Maintains the Brotli compression format and the C decoder at the root of CVE-2026-111497.

Imperva Red Team

Security research unit

Publicly demonstrated code execution on Node.js 24.22.0, withheld the exploit

The team that proved CVE-2026-111497 is exploitable as remote code execution and named the attack 'Node2Shell.'

Aikido Security

Software supply-chain security firm

Published the Python exposure mapping on October 24

First to publicly map CVE-2026-111497's reach through the Python package ecosystem.

Node.js / OpenJS Foundation

Runtime maintainer

Patched in 22.23.4, 24.22.1, 26.12.1 released October 21

The runtime that made CVE-2026-111497 the 'node2shell' headline, and the first ecosystem to ship coordinated fixes.

Timeline

February 2026 October 2026

6 events Latest: Today

Tap a bar to jump to that date

October 2026
Python exposure detailed; pyarrow and Pillow leave bundles unpatched
Today Warning

Aikido maps the flaw to brotli, brotlicffi, pyarrow, and Pillow, which ship unpatched decoder copies with no fixed wheels yet.
Today
CISA: no in-the-wild exploitation observed
Assessment

The agency records exploitation as none and automation as no; Red Hat says no reliable public code-execution PoC exists.
Yesterday
Bun and Envoy confirm their patches
Security

Bun 1.4.4 and Envoy 1.40.0 fix the decoder; the attack works in both directions — malicious clients and malicious servers.
Yesterday
NVD publishes CVE-2026-111497
Alert

The national vulnerability database lists the buffer overflow affecting Brotli 1.0.3 through 1.2.0.
2 days ago
Disclosure: Node.js and Google ship fixes
Security

Node.js releases 22.23.4, 24.22.1, and 26.12.1; Google ships Brotli 1.2.1. Imperva reveals its Node2Shell code-execution proof of concept.
3 days ago
February 2026
Root-cause fix committed to Brotli source
Development

Google's Brotli repository receives a change closing the buffer overflow, but no release carries it for nearly eight months.
February 27th, 2026

Scenarios

Ecosystem-wide patching completes by year's end

Likely Resolves by End of 2026

Discussed by: Aikido Security and package maintainers

The pattern from Node.js, Bun, and Python's brotli package repeats: each downstream project upgrades its bundled decoder as wheels land. pyarrow and Pillow publish fixed wheels, and no known exploit appears before they do.

Weaponized exploits appear before most systems patch

Possible Resolves by Q1 2027

Discussed by: Security vendors tracking pre-auth RCE reach

The attack works in both directions — a malicious client can take over a server and a malicious server can take over a client. If a working exploit leaks or gets reconstructed, scanner traffic and real attacks would follow within days, before many production systems upgrade.

Residual unpatched bundles linger, widening the attack surface

Possible Resolves by Q2 2027

Discussed by: Developer-community reporting

pyarrow and Pillow have no fixed wheels and their bundled copies sit below Brotli 1.2.1 for months. Applications that never import brotli directly stay exposed through transitive data paths like Parquet files and WOFF2 fonts, which pip-audit and Dependabot do not flag.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

April 2014

Heartbleed (2014)

A buffer over-read in OpenSSL's heartbeat extension let any internet attacker read up to 64KB of memory from a running server, exposing private keys and session data. The bug shipped in OpenSSL 1.0.1 through 1.0.1f over two years before disclosure.

Then

Public disclosure in April 2014 prompted a mass patch wave across web servers, routers, and appliances; many embedded devices went unpatched for years.

Now

It forced the creation of the Core Infrastructure Initiative and permanently changed how OpenSSL was funded and audited.

Why this matters now

Like Brotli now, Heartbleed was one bug in one ubiquitous C library that every product had to patch on its own schedule — reach, not rarity, made it severe.

December 2021

Log4Shell (2021)

A JNDI lookup in Apache Log4j's string formatting let unauthenticated attackers run arbitrary code by logging a crafted string. Proof-of-concept code appeared within a day of disclosure.

Then

An immediate wave of fixes across millions of Java applications, but unpatched systems were scanned and compromised within hours.

Now

It normalized the idea that a library-level flaw can become a company-scale incident overnight.

Why this matters now

Log4Shell shows how fast a critical RCE in a widely embedded library gets weaponized — the yardstick for worrying whether Brotli's demo exploit stays unreleased.