A severe memory-corruption flaw in Google's Brotli decoder is currently sitting inside many of the programs you use to unpack compressed data, and because this specific bug lives in the underlying C code that every program ships with its own copy of, defenders are facing a messy, product-by-product patching cycle.

Tracked as CVE-2026-111497, this Brotli decoder vulnerability allows crafted compressed data to overwrite past the end of a buffer, corrupting a program's memory, which can result in a simple crash, a memory leak, or the execution of attacker-controlled code. Imperva researchers have already demonstrated that code can run on one unpatched Node.js build, and while no real-world attacks have been reported yet, the window for patching is closing fast.

The Anatomy of the Flaw

Brotli is a compression format from Google, used across the web to shrink pages and other traffic, and the bug sits directly in the C code that unpacks a Brotli stream, meaning it travels into anything that reuses that code, from language runtimes to proxies to Python packages.

The flaw was first disclosed on October 21, when Node.js and Google shipped fixes, and more have followed product by product since. A program is only exposed if it actively decodes Brotli data that someone else controls, which happens most often when built-in HTTP clients automatically decode responses, or when frameworks automatically unpack Brotli request bodies.

Which Software Is Affected

The blast radius here is wide, because almost every modern stack relies on one of these components.

The Node2Shell Exploit and Severity Ratings

How far this flaw can be pushed depends entirely on the software, and Imperva's Red Team, which dubbed their work Node2Shell, managed to run attacker-supplied code on an unmodified Node.js 24.22.0 build for Linux on ARM64.

They delivered the payload both as a fetched response and as an Express request body. The exploit took several tries, has not been released to the public, and was not tested on other builds, which gives defenders a slight reprieve.

OpenAI, whose Codex Security team reported the flaw, describes it as enabling unauthenticated remote code execution, and notes that the flaw works in both directions. An unpatched server accepting compressed input can be taken over by a malicious client, and an unpatched client accepting compressed input, such as curl --compressed, can be taken over by a malicious server.

Severity ratings differ by who is scoring, because Google assigned the CVE and rates it 9.2, or critical, while Node.js calls it high, and Red Hat rates it 8.1, or important. No in-the-wild exploitation has been reported, and Red Hat noted there is no reliable public proof-of-concept for running code yet.

The Bizarre Fix Timeline

The history of this patch is unusual, and it highlights a major gap in open-source maintenance. The change that actually closes the flaw was added to Brotli's source code back on February 27, but no new Brotli release carried it until October 21.

OpenAI noted that the root cause was fixed in the source code in February, but it wasn't known at the time that it gave rise to a security vulnerability, and there was no more recent release of Brotli to push it out.

How to Patch and Mitigate the Brotli Decoder Vulnerability

Updating to a fixed version from the table above is the only complete fix, but you must also restart the service and rebuild any container images, because a running process keeps the old, vulnerable decoder until it restarts.

If you cannot update immediately, you have to stop decoding untrusted Brotli, and here is how you do that across different environments:

• Reject incoming requests: Block requests with Content-Encoding: br before any proxy or parser decodes the body.
• Disable automatic client decoding: Turn off automatic Brotli decoding in HTTP clients, and reject Brotli responses before they are decoded.
• In Python: Uninstall the Brotli and brotlicffi packages so clients fall back to gzip and deflate.
• Check your headers: Dropping br from the Accept-Encoding header does not help on its own, because a server can still send Brotli regardless of what the client asks for.
• Node.js exception: No workaround has been published for Node.js, so updating the runtime is the only fix.

System packages are also being fixed at different times. Debian fixed its brotli package for Debian 13 on October 23, while Amazon Linux 2023 still listed its brotli and Node.js 24 packages as pending a fix as of October 22.

FAQ

What is CVE-2026-111497?

It is a memory-corruption flaw in Google's Brotli decoder that allows crafted compressed data to overwrite a buffer, potentially leading to a crash, memory leak, or remote code execution.

Am I affected if I use Node.js?

You are exposed if you use fetch() to read a response sent with Content-Encoding: br, or if you use frameworks like Express 5 or body-parser 2 to unpack Brotli request bodies. A plain Node.js HTTP server does not decode request bodies on its own.

Why does having the Python Brotli package installed make me vulnerable?

HTTP clients such as requests, urllib3, httpx, and aiohttp for Python will automatically decode Brotli if the package is present. This means your application can be exposed without ever explicitly importing Brotli in your own code.

Does a Web Application Firewall (WAF) stop this?

Not entirely. Vercel added firewall rules on the day of disclosure, but noted those rules do not cover responses your functions fetch from other servers. For that path, only updating the runtime or library closes the hole.

I can't patch Node.js right now. What should I do?

There is no published workaround for Node.js. Updating the runtime is the only fix, and you must restart the service for the patched decoder to take effect.

Source: The Hacker News