Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Summary: A memory-corruption flaw in Google's Brotli decoder, tracked as CVE-2026-111497, lets crafted compressed data overwrite past a buffer and corrupt memory, and Imperva researchers ran attacker-controlled code on an unpatched Node.js 24.22.0 build for Linux on ARM64. The bug was first disclosed October 21 when Node.js and Google shipped fixes, and because each program ships its own copy of the decoder, Bun, .NET, the Python Brotli and brotlicffi packages, Envoy, FFmpeg, ClickHouse, and Apache Arrow each have to update separately.
What you should know: A program is exposed only if it decodes Brotli data someone else controls, and in Python that happens the moment the Brotli or brotlicffi package is installed, because requests, urllib3, httpx, and aiohttp decode Brotli responses without the application ever importing Brotli. Dependency scanners may not flag it: the CVE record names Google's Brotli repository rather than the PyPI packages, and GitHub's advisory still lists no affected package, which is what Dependabot reads.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-111497
Related: Siemens Industrial Edge Management Cyber Risks · Nov 12, 2026
Siemens Desigo, Gridscale Cyber Risks · Nov 12, 2026
Node2Shell (CVE-2026-111497) in active exploitation Cyber Risks · Oct 28, 2026