Skip to content
eastbaycyber

Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

Brotli Decoder Flaw CVE-2026-111497: Patch Node.js and Python, and What an Edge Rule Can and Cannot Do

Breaking news 7 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

TL;DR - CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder, rated CVSS 4.0 9.2 (Critical) in the CVE record. It affects Brotli 1.0.3 through 1.2.0; the fixed releases are 1.0.10, 1.1.1 and 1.2.1. - Node.js shipped fixes on October 21: 22.23.4, 24.22.1 and 26.12.1. Node lists no workaround, and Vercel says Node.js 20 is end of life and will not get the fix. - Python: Brotli 1.2.1 and brotlicffi 1.2.1.0 were published on PyPI on October 22. Aikido reports that pip-audit, Dependabot and Safety did not yet flag the vulnerable versions as of October 23. - CISA’s coordinator entry in the CVE record (October 23) lists exploitation as none. Aikido reports code execution against an unmodified Node.js 24.22.0 build in researcher reports, but not reliably. Treat it as urgent anyway: the bug is remotely reachable. - A WAF rule on Content-Encoding: br helps for inbound requests only. It does nothing for Brotli responses your own services fetch. Patching is still required.

This week’s triage: all of this week’s critical issues, ranked by what to patch first: Critical vulnerabilities, October 17 to 24, 2026.

What happened#

Google, acting as the CNA, published the CVE record for CVE-2026-111497 on October 22, 2026. The record describes a buffer overflow in the Brotli decoder (c/dec/decode.c) that lets a remote, unauthenticated attacker using a crafted Brotli stream corrupt adjacent decoder state memory, disclose memory contents, crash the process, or potentially execute code. The weaknesses are listed as CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value). The finders are credited as OpenAI Codex Security (Khai Tran and Sylvie Mayer).

The Node.js project’s October 21 security release explains the mechanism for its bundled copy: the decoder treated an invalid block switch as a request for more input rather than a permanent format error, so the streaming decoder kept appending bytes to an eight-byte internal buffer. Node rates it High. Node.js 22.x, 24.x and 26.x are affected until updated.

Brotli is a compression format used for web content. It is bundled in Node.js and built into many libraries and operating system packages, which is why the same bug shows up in several places at once.

Who is affected#

  • Node.js 22.x, 24.x and 26.x that decompress untrusted Brotli data. The Node advisory describes data passed to node:zlib. Aikido’s analysis adds that Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding: br, that fetch() decodes Brotli responses automatically, and that a bare Node.js HTTP server does not decode incoming Brotli bodies on its own. That is Aikido’s reading rather than the Node project’s statement.
  • Python applications using the Brotli package (1.2.0 and earlier) or brotlicffi. Aikido says HTTP libraries such as urllib3, requests, httpx and aiohttp decode Brotli automatically when one of these packages is installed, so your own code does not need to import it.
  • Native libbrotli, other runtimes and OS packages. The CVE record lists affected ranges of 1.0.3 to before 1.0.10, 1.1.0 to before 1.1.1, and 1.2.0 to before 1.2.1. Distributions may backport the fix without changing the version number, so check the vendor’s security notice rather than the version string. The CVE record’s references include a Debian LTS announcement.
  • Container images built on vulnerable base images stay vulnerable until rebuilt.
  • Not affected on this evidence: software that never decodes Brotli from untrusted sources. Aikido notes that Apache’s standard mod_brotli and Nginx do not decode Brotli by default.

What defenders should do now#

  1. Update the runtime. Move to Node.js 22.23.4, 24.22.1 or 26.12.1, rebuild container images on a patched base, and redeploy. If you are on Node.js 20, move to a supported line; it will not receive this fix.
  2. Update Python packages. Install Brotli>=1.2.1 and brotlicffi>=1.2.1.0, regenerate lock files, and rebuild images. Do not rely on dependency scanners alone until they carry the advisory.
  3. Find what you actually run. Useful starting points: node --version pip show Brotli brotlicffi dpkg -l | grep -i brotli rpm -qa | grep -i brotli Check the deployed artifact (the running image), not a laptop or a build machine.
  4. Add an inbound edge rule as a stopgap, not a fix. Block or count requests whose Content-Encoding header includes br, matched case-insensitively. Review logged traffic first if legitimate clients might send Brotli request bodies, which is uncommon.
  5. Cover the outbound path separately. A WAF in front of your application cannot see Brotli responses that your own services fetch from other servers (webhooks, URL previews, crawlers, API clients). Aikido’s guidance is to stop advertising br in Accept-Encoding and reject responses with br in Content-Encoding before decoding, noting that a malicious server can send Brotli regardless of what you ask for.
  6. Track patching and the edge rule as separate items with their own owners, and keep watching for exploitation reports.

Cloud and edge options#

What the providers have published as of October 24. These are their statements, summarized here; confirm the details in their own pages before relying on them.

  • Microsoft Azure. Microsoft’s Azure WAF post (modified October 23) covers Brotli protection. As summarized by an independent write-up (we could not read the body of Microsoft’s page directly), the Default Rule Set 2.2 rule 920450 covers inbound requests on Application Gateway and Front Door Premium in Prevention mode only, earlier rule sets lack the same header restriction, and Front Door Standard and other policies without that managed protection need a custom rule. Microsoft also says WAF cannot protect an application that decodes a malicious response from an external service, and that patching remains necessary.
  • Vercel. Vercel’s bulletin says it deployed WAF rules on October 21 that apply automatically to every project at no cost, and that they cover traffic through Vercel’s network but not responses a function fetches from other servers. It says to upgrade Node.js regardless for runtimes it does not manage (external backends, self-hosted Next.js, your own container images, CI runners). Projects on Node.js 20.x should move to 22.x or 24.x.
  • AWS and Google Cloud. We had not found an AWS or Google Cloud notice, managed rule or bulletin for this CVE as of October 24. If you use AWS WAF or Cloud Armor, the generic approach is a custom rule that matches the Content-Encoding request header containing br (with lowercase normalization) and blocks or counts it. That is our suggestion based on the vendor guidance above, not an AWS- or Google-published rule, and we have not tested it. Test in count mode before blocking.

Sources

Last verified: 2026-10-24

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.