Brotli is the compression your browser, your CDN and your Node.js runtime use without anyone thinking about it. On October 21, an out-of-bounds write in its decoder was fixed that, with crafted data, can end in code execution. What matters to anyone running services isn't just the bug, but how many different copies of the decoder live in your stack.
What CVE-2026-111497 Is
It's a memory-corruption flaw in Brotli's C decoder: a crafted compressed input can write past the end of a buffer. The possible outcomes are a crash, a memory leak or attacker-controlled code execution. It was disclosed on October 21, 2026, when Node.js and Google shipped fixes and other products followed. According to The Hacker News, the report came from OpenAI's Codex Security team; Node.js credits Khai Tran and Sylvie Mayer, and maintainers Matteo Collina and Antoine du Hamel for the fix.
Who Is Affected and Which Version Fixes It
Envoy and Istio are vulnerable only if the Brotli decompressor is configured or enabled. The October 21 Node.js release fixed ten flaws in total, four of them high severity, and offered no alternative mitigation: updating is the only way out.
How It Gets to Code Execution: Exposure Conditions
The decoder is only dangerous when it processes data you don't control. In Node.js and Bun that happens when you read a fetch() response with Content-Encoding: br, or when you parse Brotli request bodies in Express 5 or body-parser 2; a basic Node HTTP server doesn't decode bodies on its own. In Python, simply having Brotli or brotlicffi installed is enough: clients such as requests, urllib3, httpx and aiohttp decode Brotli automatically. Imperva Red Team, which calls its work Node2Shell, demonstrated code execution on an unmodified Node.js 24.22.0 on Linux ARM64; the exploit took several attempts, hasn't been published and wasn't tested on other builds. As of October 23, CISA assessed it as having no known exploitation, and Red Hat said there is no reliable public proof of concept.
Why It Took Eight Months: The Problem of Copies
The fix was committed to Brotli's source code on February 27, 2026, but no new release included it until October 21. OpenAI maintained that the root cause "had been fixed in Brotli's source code since February." Each runtime (Node.js, Bun, Python packages, Envoy) bundles its own copy, so a fix in the repository protects no one until each project pulls it in and ships it. By the end of this week, Debian had already fixed its package in Debian 13, while Amazon Linux 2023 still listed it as pending on October 22. GitHub didn't list an affected package in its advisory database, so Dependabot may not alert you about the Python packages.
Mitigations If You Can't Update Today
- Reject requests with
Content-Encoding: brbefore any proxy or parser decodes them. - Disable automatic Brotli decoding in your HTTP clients; in Python, uninstall
Brotliandbrotlicffiso gzip/deflate is used instead. - Removing
brfromAccept-Encodingdoesn't help: a server can still reply with Brotli. - After updating, restart services and rebuild container images: a running process keeps the old decoder.
What It Means for a Company Running AI Services
fetch() many external URLs, exactly the condition that triggers this bug. Inventory which runtimes (Node, Bun, Python) run in your AI services and which Brotli version they bundle, prioritize the ones that consume third-party content, and don't assume your dependency scanner will flag it. The case also illustrates a trend: having an AI tool report the flaw shortens the time between discovery and disclosure, but not the time your update chain takes.