Brotli Decoder Flaw CVE-2026-111497 Spreads RCE Risk to Python, Bun, and Envoy

Key points

• CVE-2026-111497 is a buffer overflow in Google's Brotli C decoder, affecting Node.js, Bun, Python packages, Envoy, and Istio.
• Imperva's 'Node2Shell' exploit demonstrated code execution on unpatched Node.js 24.22.0 for Linux ARM64, though it has not been released.
• OpenAI's Codex Security team reported the flaw, noting it allows unauthenticated remote code execution via crafted compressed data.
• Fixes were released on October 21, 2026, for Node.js, Bun, and Envoy, with Python packages patched in version 1.2.1.
• No in-the-wild exploitation has been reported, and CISA assessed the risk as low with no active automation.

Background

This vulnerability was first disclosed on October 21, 2026, following Node.js and Google releasing patches. Earlier coverage highlighted the critical nature of the flaw and the availability of fixes for major software versions. The current report expands the scope to include Python and other widely used software, detailing specific exposure conditions and mitigation strategies.

Why it matters

The flaw affects critical infrastructure and development tools, potentially allowing attackers to execute arbitrary code on servers or clients. Organizations must update affected software or disable Brotli decompression to prevent exploitation, as the bug is embedded in multiple independent codebases.

What to watch

Organizations should update to patched versions of Node.js, Bun, Envoy, and Python packages immediately. For those unable to update, disabling Brotli decompression or rejecting 'Content-Encoding: br' requests is recommended. Dependency scanners may not yet flag Python packages, so manual checks are advised.