cyber.hendryadrian.com
Vulnerability & Exploit · opensourcemalware.com

Brotli Decoder Vulnerability Puts Bundled Copies Across Ecosystems at Risk

· Original article ↗

Summary

Open Source Malware says CVE-2026-111497 affects bundled Brotli decoders across many ecosystems. Malformed block-type switches can cause an out-of-bounds write; the article lists fixes and urges teams to find bundled copies and avoid decoding untrusted data.

Key points

  • CVE-2026-111497 is an out-of-bounds write in the Brotli C decoder: an invalid block-type switch is treated as a request for more input, allowing a streaming decoder to write beyond an 8-byte internal buffer.
  • The article says Imperva demonstrated code execution in Node.js; Open Source Malware reports testing that found denial-of-service was relatively easy to achieve.
  • Brotli is embedded or wrapped in projects across multiple ecosystems, so updating Node.js or a system libbrotli package may not fix software carrying its own copy.
  • The article lists fixes for google/brotli in versions 1.0.10, 1.1.1 and 1.2.1, along with fixes across projects including Node.js, Bun, PyPI Brotli, Envoy and browsers.
  • Open Source Malware says the fix commit was on google/brotli's public master branch from February 27, 2026, but was not released or identified as a security fix until October.
  • The article recommends searching vendored code, dependencies and images for Brotli copies, upgrading and rebuilding embedded software, and avoiding Brotli decoding of untrusted input where no fix is available.

Article Details

Vulnerability Types
  • Out-of-bounds write
Affected Versions
  • google/brotli 1.0.3 through 1.2.0
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Where no fix exists, stop decoding Brotli data from untrusted sources.
  • Remove br from Accept-Encoding on outbound requests and reject Content-Encoding: br on inbound requests.
  • Do not open Brotli-compressed Parquet files or WOFF2 fonts from untrusted sources.

CVE

CVE-2026-111497CVE-2026-111497 is an out-of-bounds write in c/dec/decode.c in google/brotli. When a stream asks for a block-type switch that it isn’t allowed to make, the old decoder reports “I need more input” instead of “this stream

Products

BrotliSo, about that Brotli bug…brotlicffipackage ships the same vulnerable decoder as Node.js. We disclosed the vulnerability in the brotli and brotlicffi packages to the Python Security team and they created two new advisories: PYSEC-2026-4322 for brotli,Node.jsOn October 22, we showed that the PyPI Brotli package ships the same vulnerable decoder as Node.js. We disclosed the vulnerability in the brotli and brotlicffi packages to the Python Security team and they created two

Related Articles