Brotli CVE-2026-111497 Affects Python and HTTP Libraries
Summary
CVE-2026-111497 is an out-of-bounds write in vulnerable Brotli decoders, reachable through attacker-controlled compressed data and potentially enabling memory disclosure, crashes or code execution. Fixes are available for Brotli, Python packages and affected runtimes.
Key points
- The article identifies an out-of-bounds write in Brotli decoder versions through 1.2.0; a remote, unauthenticated attacker may trigger memory disclosure, a crash or potentially arbitrary code execution with crafted compressed data.
- The flaw can be reached through inbound Brotli-compressed request bodies or responses from servers an application contacts. Python HTTP clients may load vulnerable Brotli packages automatically when installed, including as transitive dependencies.
- The article lists Brotli 1.2.1 and brotlicffi 1.2.1.0 as fixed Python package versions, and provides patched releases for Node.js, Bun, Envoy, Istio and other components.
- The root cause involves decoder handling of block-switch errors. The upstream fix makes decoding stop on a format error rather than continuing with invalid block state.
- Where upgrades are not yet possible, the article recommends removing optional Python Brotli packages or rejecting Brotli-encoded traffic before decoding; changing Accept-Encoding alone does not prevent a server from sending Brotli data.
- As of October 23, the article says advisory databases did not yet map the CVE to the affected PyPI packages, so pip-audit, Dependabot and Safety might not flag them.
- The article cites a report of no in-the-wild exploitation for Node.js as of October 22; it does not establish that the vulnerability is unexploited across all affected components.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Unchecked return value
- Severity
- Critical; CVSS v4.0 score 9.2
- Affected Versions
- Brotli 1.0.3–1.2.0
- brotlicffi 1.2.0.x
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Where Brotli support is optional, uninstall Brotli and brotlicffi and rebuild or restart affected workloads.
- Reject incoming requests with Content-Encoding: br before a vulnerable decoder processes the body.
- For outbound requests, disable Brotli response decoding or reject responses with Content-Encoding: br before decoding begins.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationA crafted Brotli request body can reach a vulnerable decoder in an HTTP-facing application and trigger memory corruption.T1203 · Exploitation for Client ExecutionA malicious server can send a crafted Brotli-compressed response to an unpatched client that decodes it, potentially enabling code execution.
CVE
Vendors
Products
Brotli⚠️ Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli databrotlicffiYou’re exposed if any environment has Brotli 1.2.0 or earlier or brotlicffi 1.2.0.x installed, since HTTP clients such as requests, httpx, and aiohttp load these packages automatically when they’re present. Upgrade toBunUpdate 4:12PM PT: Patches are available for libbrotli, Python, C++, NodeJS, bun, Envoy and more coming. Apache and Nginx do not decode brotli by default.EnvoyUpdate 4:12PM PT: Patches are available for libbrotli, Python, C++, NodeJS, bun, Envoy and more coming. Apache and Nginx do not decode brotli by default.IstioIstio: the fix is included in 1.29.9, 1.30.6, and 1.31.2. Use a newer supported release in the corresponding line; the 1.29 branch is end of life.Node.jsfrom Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary
Tools
AddressSanitizera CVSS 4.0 score of 9.2, and Node.js rates it high severity. OSM built Brotli 1.2.0 and 1.2.1 with AddressSanitizer and ran a crafted stream through both. Version 1.2.0 consumed all of the roughly 23 MB stream andDependabotthem. As of October 23, advisory databases don’t map the CVE to either PyPI package, so pip-audit, Dependabot, and Safety won’t flag vulnerable versions yet.pip-auditthat bundle them. As of October 23, advisory databases don’t map the CVE to either PyPI package, so pip-audit, Dependabot, and Safety won’t flag vulnerable versions yet.Safetyof October 23, advisory databases don’t map the CVE to either PyPI package, so pip-audit, Dependabot, and Safety won’t flag vulnerable versions yet.