Brotli RCE flaw hits Node.js, Python, Envoy: what to patch

If your software decompresses Brotli data from anyone you do not control, update it. A single bug in Google’s Brotli decoder, tracked as CVE-2026-111497, reaches Node.js, Python’s Brotli packages, Envoy and other software that bundles the library. We read Node.js’s security release post, the GitHub advisories for the Python packages and Envoy, Brotli’s upstream releases and commit, and write-ups by Aikido and Imperva. This article covers what the flaw is, which versions fix it, who found it and what you can do before you can patch. It leaves out exploit details.

What is CVE-2026-111497?

An out-of-bounds write in Brotli’s decoder that crafted input can trigger. The GitHub advisory describes a buffer overflow in c/dec/decode.c in Brotli 1.0.3 through 1.2.0 on all platforms that allows a remote unauthenticated attacker to corrupt adjacent decoder state, disclose memory, cause a denial of service or potentially execute code. Node.js describes the cause as an invalid block switch reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending bytes to an eight-byte internal buffer. It says an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, leading to a crash, disclosure of process memory or remote code execution. The flaw works in both directions: Aikido, relaying OpenAI’s report, says a malicious client can attack an unpatched server and a malicious server an unpatched client that accepts compressed responses.

The names differ by source. Imperva calls its analysis of the Node.js case “Node2Shell”, and Aikido uses “HTTP2Shell” for the wider spread. Neither is an official name.

Which versions fix it?

Upstream Brotli published 1.2.1, 1.1.1 and 1.0.10 on October 21 at 19:27 UTC, and the rest follow from that. Per the sources we read:

• Node.js: 22.23.4, 24.22.1 and 26.12.1, from the October 21 security releases, which affect the 22.x, 24.x and 26.x lines.
• Python packages: Brotli 1.2.1 and brotlicffi 1.2.1.0. GitHub’s advisory covers Brotli from 1.0.3 below 1.2.1 and brotlicffi from 1.0.3 below 1.2.1.0.
• Envoy: 1.40.0, 1.39.3, 1.38.6 and 1.37.8, with 1.36.12 also fixed on an unsupported branch. Envoy’s advisory says the affected versions are 1.39.2, 1.38.5, 1.37.7 and 1.36.11 and that it impacts deployments with the Brotli decompressor configured.
• Bun and Istio: Aikido lists Bun 1.4.4 and Istio 1.29.9, 1.30.6 and 1.31.2, with Istio’s 1.29 branch end of life. We did not read those projects’ own advisories.
• curl and others: Aikido says curl and libcurl need an updated Brotli dependency or the vendor’s security-fixed package, and that bundled or statically linked copies need a rebuilt application. We found no curl advisory, so check your distribution.
• Operating-system packages may carry the fix without changing the upstream version number, according to Aikido.

Who is exposed?

Anything that decodes Brotli from untrusted data, on either side of an HTTP exchange. Imperva says it ran code in applications on the official Node.js 24.22.0 Linux arm64 image, through a compressed response consumed by Node’s built-in fetch() and through request bodies parsed by Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0, and that 24.22.1 rejected the same inputs. It adds that execution took multiple attempts in its setup, and it has added WAF rules. For Python, Aikido says HTTP clients such as requests, httpx and aiohttp load the Brotli packages automatically when installed. It says Apache’s standard mod_brotli does not decode Brotli, so a stock Apache is not in the path by default.

What can you do before patching?

Reduce where Brotli reaches a vulnerable decoder. These are Aikido’s suggestions, and they are workarounds, not fixes:

• Inbound: reject requests whose Content-Encoding includes br at the reverse proxy, load balancer or middleware, matching case-insensitively and inside lists, before any decoder sees the body.
• Outbound: remove br from Accept-Encoding, and also reject br responses before automatic decoding. Aikido says changing Accept-Encoding alone is not enough, because a malicious server can send Brotli anyway.
• Python: where Brotli is optional, uninstall both Brotli and brotlicffi, remove extras like httpx[brotli], rebuild and restart. Servers that send Brotli regardless may then produce errors.
• Check, rebuild, redeploy. Update lockfiles, rebuild container images and compiled executables, and verify that running workloads use the patched components. Aikido reported on October 23 that pip-audit, Dependabot and Safety did not yet flag the PyPI packages, so check manually even though a GitHub advisory for them was published on October 22.

Who found it, and why did it take until October?

Node.js credits OpenAI Codex Security, Khai Tran and Sylvie Mayer, with reporting its advisory, and Matteo Collina and Antoine du Hamel with the fix. The Envoy advisory credits OpenAI Security Research. Aikido relays OpenAI’s statement that OpenAI discovered the bug in February, when the root cause was fixed in Brotli’s source without anyone recognizing it as a security flaw. Brotli’s repository supports the timeline: the fixing commit, “Detect and report invalid stream earlier”, is dated February 27, 2026, and no fixed release appeared until October 21. Aikido’s conclusion is that every project that bundles Brotli had to ship its own update. We could not read OpenAI’s own page, and the sources do not say whether AI tools were used in the discovery.

What is still unknown?

• Exploitation in the wild. We found no report of it in the sources we read, and none of them claims it.
• Which other software is affected. Aikido’s list is broader than the advisories we read, and we did not confirm curl, Bun or Istio ourselves.
• How severe it is. Node.js rates its advisory high, GitHub marks the PyPI and Envoy advisories critical, and Aikido’s CVSS v4.0 score of 9.2 does not appear in the GitHub records we read.
• How many bundled copies exist in containers, vendored code and compiled binaries that no scanner maps to this CVE yet.

What to keep in mind

These are our observations:

• A fix in source is not a patch. The upstream commit was in February, and by our arithmetic nearly eight months passed before a release, which is why bundlers each had to react.
• Patch the bundled copies, not just the package manager. Node.js, Bun and Envoy each ship their own Brotli, so updating one library does not protect the others.
• Read the severity for your product. The ratings differ across sources, and for services that decompress untrusted bodies the exposure matters more than the label.
• It landed alongside PHP. Our PHP report covers critical bugs fixed on the same day, and the same Node.js release also carries the update for the eMudhra intermediate CA compromise.

Editorial review: October 24, 2026 (AI). Prepared from Node.js’s October 21 security release post (the Brotli section and the list of bundled updates; the rest of the post was skimmed), the GitHub advisories for the PyPI packages and Envoy (read through the GitHub API), Brotli’s upstream releases and fixing commit (GitHub API), Aikido’s article (October 23, updated October 24) and Imperva’s article (October 22), both read as page text. We did not read OpenAI’s own account, the Bun, Istio or curl advisories, or any exploit. This is not security advice for your environment; follow your vendors’ guidance.