Product
brotlicffi
- First Reported
- Oct 23, 2026
- Latest Reported
- Oct 24, 2026
Reported Context (3)
- A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Brotli Flaw Affects Node.js, Bun, Python Packages and Envoy; RCE Shown on One Node.js Build
- Node2Shell ain’t just a Node.js bug: the PyPI Brotli and brotlicffi packages ship the same vulnerable C decoder. Node2Shell Vulnerability Also Affects Python Brotli Packages
- You’re exposed if any environment has Brotli 1.2.0 or earlier or brotlicffi 1.2.0.x installed, since HTTP clients such as requests, httpx, and aiohttp load these packages automatically when they’re present. Upgrade to Brotli CVE-2026-111497 Affects Python and HTTP Libraries
CVE (1)
People (4)
MITRE ATT&CK (2)
Vendors (1)
Products (6)
Tools (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.