Brotli CVE-2026-111497 hits Bun, Python and Envoy, not just Node
The Brotli decoder bug behind the Node.js RCE also affects Bun, Python Brotli, brotlicffi, Envoy and Istio. Fixed versions, exposure paths and stopgaps.
On Friday we told you to upgrade Node.js for the Brotli bug. That was half the job. CVE-2026-111497 lives in Google's Brotli decoder itself, and every program that ships its own copy of that decoder carries the bug. The Hacker News lists the rest: Bun, Python's Brotli and brotlicffi packages, Envoy, Istio, and cdxgen. If you patched Node and stopped, your Python scraper and your proxy are still open.
What actually happened with the Brotli decoder flaw
The bug is a memory-corruption flaw. Crafted compressed data writes past the end of a buffer, which can crash the process, leak memory, or possibly run attacker code. OpenAI's Codex Security team reported it. The fix landed in Brotli's source in February, but no Brotli release carried it until October 21. Eight months of a fixed bug sitting in an unreleased commit.
Fixed versions, per the report:
- Google Brotli (C library): 1.0.10, 1.1.1, 1.2.1 (affected: 1.0.3 to 1.2.0)
- Node.js: 22.23.4, 24.22.1, 26.12.1
- Bun: 1.4.4
- Python Brotli: 1.2.1. brotlicffi: 1.2.1.0
- Envoy: 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12
- Istio: 1.31.2, 1.30.6, 1.29.9
- cdxgen: 13.5.0, 12.8.9
Severity depends on who scores it: Google rates it 9.2, Red Hat 8.1. Imperva's red team showed code execution on one unmodified Node.js build, but has not released the exploit. No attacks in the wild have been reported, and CISA's October 23 assessment recorded exploitation as "none."
Why it matters for your business
Python is the sneaky one. If Brotli or brotlicffi is installed, requests, urllib3, httpx and aiohttp will decode br responses automatically, even if your code never imports Brotli. Every scraper, sync job, and AI agent tool that fetches outside URLs is in scope. Run pip show brotli brotlicffi in every environment.
Your scanner may say you are clean. The report notes GitHub's advisory lists no affected package, and the PyPI advisories were only added October 23. Check versions by hand this time.
Patching is not the last step. Running processes keep the old decoder in memory. Restart services and rebuild container images after you upgrade.
Stopgaps exist if you cannot upgrade today. Reject requests with Content-Encoding: br at the edge, or uninstall the Python Brotli packages so clients fall back to gzip. Removing br from Accept-Encoding does not help, because a hostile server can send Brotli anyway.
Key takeaways
- CVE-2026-111497 is in Google's Brotli decoder, so every bundled copy needs its own update
- Bun 1.4.4, Python Brotli 1.2.1, brotlicffi 1.2.1.0 and new Envoy and Istio builds carry the fix
- Python HTTP clients decode Brotli automatically when the package is installed
- Dependency scanners may miss it, so check installed versions manually
- Restart services and rebuild images after you patch
Do you know every place your stack decompresses data? We map the runtimes, packages and proxies behind your store and back office, then keep them patched on a schedule you can see. Ask us to check your Brotli exposure, or see how we maintain production systems.
Sources: The Hacker News, Node.js October 21, 2026 security releases.
- #security
- #brotli
- #python
- #patching
- #devops
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Railway breach: rotate every secret stored before October 21
The Railway breach exposed environment variables for up to 1.85% of workspaces. The attacker wanted AI API keys. Here is the rotation list and what to change.
Read itPHP CVE-2026-115560: turn off session upload progress now
PHP's October 23 advisory flags CVE-2026-115560, a new session upload progress RCE path not fixed by PHP2Shell patches. One php.ini line closes it.
Read it