> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Brotli Bug Puts Node, Bun and Python Apps at Risk
- URL: https://blog.harshkohli.com/brotli-cve-2026-111497-node-bun-python/
- Published: 2026-10-24T12:56:08.000Z
- Updated: 2026-10-25T07:39:04.000Z
- Description: A critical Brotli decoder flaw, CVE-2026-111497, hits Node.js, Bun, Envoy and Python HTTP clients. Here are the fixed versions and what to update.
- Author: Harsh Kohli
- Tags: Tech News, Software

If you run anything on Node.js, Bun or Python that talks to the internet, this is the patch I'd do before the weekend is over. A memory bug in Google's Brotli decompression library, tracked as CVE-2026-111497, turns out to reach far more software than the Node.js fix that first put it on the radar. I spotted the wider picture in [a post from The Hacker News on X](https://x.com/TheHackersNews/status/2113916077923303786?ref=blog.harshkohli.com) and then went through the vendor advisories myself.

## What happened

Brotli is the compression format behind the `br` content encoding that most browsers and servers use. Google's C decoder, versions 1.0.3 through 1.2.0, can be tricked by a malformed stream into writing past the end of a buffer in memory. According to the [NVD entry](https://nvd.nist.gov/vuln/detail/cve-2026-111497?ref=blog.harshkohli.com), a remote attacker with no login can use a crafted stream to corrupt memory, leak data, crash the process or possibly run code. Google rates it 9.2 out of 10 on CVSS 4.0, and the fixed releases are 1.0.10, 1.1.1 and [1.2.1](https://github.com/google/brotli/releases?ref=blog.harshkohli.com).

Node.js shipped fixes first, in its [October 21 security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases?ref=blog.harshkohli.com), crediting OpenAI's Codex Security researchers with the report. Since then Bun, Envoy and the Python packages have all confirmed they bundle the same decoder. Imperva's team, which named the attack Node2Shell, got code running on an unpatched Node.js 24 build on Linux, though that exploit hasn't been released, according to [The Hacker News' write-up](https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html?ref=blog.harshkohli.com).

## Why it matters

The nasty bit is how quietly you can be exposed. In Node.js and Bun, the built-in `fetch()` decodes a Brotli response on its own, so a malicious server you call is enough. In Python, you don't need to import Brotli anywhere. If the `Brotli` or `brotlicffi` package happens to be installed, clients like requests, urllib3, httpx and aiohttp will decode `br` responses automatically, per the [PyPA advisory](https://github.com/pypa/advisory-database/blob/main/vulns/brotlicffi/PYSEC-2026-4323.yaml?ref=blog.harshkohli.com). Webhooks, link previews and scrapers are the obvious paths in.

## What to do

- **Node.js:** move to 22.23.4, 24.22.1 or 26.12.1\. Version 20 and older are end of life and won't get a fix.
- **Bun:** update to 1.4.4 and rebuild any binaries made with `bun build --compile`, as the [Bun advisory](https://github.com/oven-sh/bun/security/advisories/GHSA-663w-cv8g-jj2p?ref=blog.harshkohli.com) explains.
- **Python:** run `pip list | grep -i brotli` and upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0\. If you can't, uninstalling them makes clients fall back to gzip.
- **Envoy and Istio:** only setups with Brotli decompression turned on are hit. Envoy's fixed builds are listed in [its advisory](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr?ref=blog.harshkohli.com).
- **Linux servers:** install your distro's libbrotli security update, then restart services and rebuild container images. A running process keeps the old decoder until it restarts.

It's the second big server-side patch this week after [PHP's session upload bug](https://blog.harshkohli.com/php-cve-2026-115560-session-upload-progress/), so if you keep a checklist for your boxes, now's a good time to run through it.