Cybersecurity
Brotli flaw affects Node.js and other software
A memory-corruption bug in Google’s Brotli decoder led to fixes across Node.js, Bun, Python packages and related software after researchers showed code execution on one unpatched Node.js build.
- Google’s Brotli decoder flaw was tracked as CVE-2026-111497 and could corrupt memory in programs that processed crafted compressed data.
- Imperva researchers showed code execution on an unpatched Node.js 24.22.0 build for Linux on ARM64.
- The article said no in-the-wild exploitation had been reported, and the same code execution had not been demonstrated on the other affected software.
- Google rated the flaw 9.2 on CVSS 4.0, Node.js called it high, and Red Hat rated it 8.1.
The flaw was in Google’s Brotli decoder and affected software that unpacked Brotli data from untrusted sources. The article said the bug could overwrite memory and lead to crashes, leaks or code execution.
Imperva researchers said they ran attacker code on an unmodified Node.js 24.22.0 build for Linux on ARM64. They used both a fetched response and an Express request body, and the exploit had not been released.
Exposure depended on settings and package use. The article said Node.js and Bun could be reached through compressed responses or request bodies, Envoy and Istio only when decompression was enabled, and Python applications could be exposed if Brotli or brotlicffi was installed. Vercel said its firewall rules did not cover responses fetched by functions.
OpenAI’s Codex Security team reported the flaw and said it could work against both compressed servers and clients. CISA recorded no exploitation on 23 October, Red Hat said there was no reliable public proof-of-concept, and Google rated the CVE 9.2. The source also said Debian fixed its brotli package on 23 October, while Amazon Linux 2023 still listed brotli and Node.js 24 packages as pending a fix on 22 October.
Named in this story
People
- Khai Tran
- was credited by Node.js for reporting the flaw
- Sylvie Mayer
- was credited by Node.js for reporting the flaw
- Matteo Collina
- was credited for the fix
- Antoine du Hamel
- was credited for the fix
Companies
- supplied the Brotli decoder that contained the flaw
- Vercel
- said its firewall rules did not cover responses fetched by functions
- Imperva
- its researchers demonstrated code execution on Node.js
- OpenAI
- its Codex Security team reported the flaw
- Red Hat
- said there was no reliable public proof-of-concept
Organisations
- Debian
- fixed its brotli package for Debian 13 on 23 October
Governments and agencies
- CISA
- recorded no exploitation on 23 October
Products and systems
- Brotli
- the compression format whose decoder contained the flaw
- Node.js
- shipped a fix and was shown vulnerable on one build
- Bun
- was named as affected software
- Python Brotli
- was named as affected software
- brotlicffi
- was named as affected software
- Envoy
- was named as affected software when Brotli decompression was enabled
- Istio
- was affected only when Brotli decompression was enabled
- Amazon Linux 2023
- still listed brotli and Node.js 24 packages as pending a fix
How the source tells it
The piece was a technical security advisory in a neutral register, with operational remediation advice but no distinct emotive framing.
No emotive framing was found in the original.