Brotli Flaw Rated 9.2 Critical Reaches Bun, Envoy, Istio and curl

A memory-corruption bug in Google’s Brotli compression library, which Node.js patched on Wednesday, carries a critical severity score of 9.2 and reaches well beyond Node. The Bun runtime, the Envoy and Istio proxies, Python’s popular HTTP clients and command-line tools such as curl can all be exposed if they decode Brotli data with an unpatched copy of the library.

The CVE record for CVE-2026-111497, published by Google, describes “a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms” that “allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream”. The fixed upstream releases are 1.0.10, 1.1.1 and 1.2.1. The record credits Khai Tran and Sylvie Mayer of OpenAI Codex Security, and the US cyber agency CISA’s assessment attached to it lists no known exploitation.

Servers and clients are both at risk

Brotli is used to shrink web pages, API responses and files, so the vulnerable code runs wherever software unpacks that data. OpenAI said on X late on 23 October that its agents found the flaw while red-teaming the company’s own training environment, and that it works in both directions: “an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl –compressed”) could be taken over by a malicious server.”

The bug was not new to the code. “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli,” OpenAI wrote. Because Brotli is built into so many other projects, each of them has had to ship its own update.

The security firm Aikido, which called the Node-only version “node2shell”, has renamed the wider problem “HTTP2Shell”. Writing on X, it said: “This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.”

Fixes are out for the biggest projects

A coordinated advisory page, which OpenAI linked to and which thanks the OpenJS Foundation for helping coordinate the response, lists these fixed versions:

• Node.js: 22.23.4, 24.22.1 and 26.12.1
• Bun: 1.4.4, which includes Brotli 1.2.1
• Envoy: 1.40.0, 1.39.3, 1.38.6 and 1.37.8 (1.36.12 also has the fix, but that branch is unsupported)
• Istio: 1.29.9, 1.30.6 and 1.31.2 (1.29 is end of life)
• Google Brotli upstream: 1.0.10, 1.1.1 and 1.2.1

For Python, Aikido says the fixes are Brotli 1.2.1 and brotlicffi 1.2.1.0. Linux distributions are shipping their own packages; the CVE record already points to a Debian long-term support advisory.

Python apps can be exposed without importing Brotli

Aikido says urllib3, and therefore requests, plus httpx with its brotli extra, aiohttp and Scrapy all decode Brotli responses automatically when the package is installed. The Brotli package alone has “82.8 million downloads per month”, it says. As of 23 October, advisory databases did not map the CVE to either Python package, so Aikido said pip-audit, Dependabot and Safety would not yet flag vulnerable versions. Attacker data can arrive in a response from a server the app calls, through features such as webhook deliveries, URL previews or crawlers, or in a Brotli-compressed request body. Aikido added that Apache’s standard mod_brotli and Nginx leave Brotli decoding off by default.

The flaw lands in a week already crowded with emergency patching. The PHP2Shell flaws drew early attack attempts and left 32 UK government services offline, and Oracle shipped 1,295 security patches in its quarterly update.

Blocking Brotli is the stopgap

Where patching has to wait, the advisory page recommends switching off Brotli decoding of untrusted data while keeping gzip and deflate. Servers should reject requests marked Content-Encoding: br before any proxy, middleware or body parser unpacks them. Clients need to refuse Brotli responses before decoding, because removing br from the Accept-Encoding header “alone does not stop a server from sending it”.

Envoy and Istio users are told to disable the Brotli decompressor filter for both requests and responses, and to protect anything downstream, since a disabled filter passes compressed data on. Next.js sites can set images.unoptimized until Node.js is updated. The page also flags Electron-based desktop apps, which can carry several copies of Brotli, along with curl and libcurl, the Python and Java bindings and font decoders. After updating, containers and bundled executables have to be rebuilt and every service restarted.

An eight-month-old fix exposes the downstream patching gap

The striking detail is the timeline. The code that closes this hole sat in Brotli’s source for months, but because nobody had recognised it as a security fix, no release carried it and no downstream project had a reason to pick it up. A library this deeply embedded is only as safe as the slowest project that bundles it, and here that chain includes runtimes, proxies, Python packages, desktop apps and operating-system builds, each with its own release schedule.

The client side deserves particular attention. Most patch planning starts with what a company exposes to the internet, but this flaw also lets a hostile server attack the software that fetches from it, which puts crawlers, webhook senders and command-line tools in scope. The split between Node.js’s “high” rating and the record’s 9.2 critical score matters less than that reach. With scanners not yet flagging the Python packages, teams will have to search their own dependency trees, and the job is finished only when every copy of the decoder is found, not just the one in Node.

Sources

• CVE Program, CVE-2026-111497, “Out-of-Bounds Write in Google Brotli Decoder”
• OpenAI on X, 23 October 2026
• Patch the Planet, “Brotli decoder vulnerability”, updated 23 October 2026
• Aikido, “Node2Shell evolves to HTTP2Shell”, 23 October 2026
• Aikido on X, 23 October 2026

Related stories

• Node.js Fixes Four High-Severity Flaws, Including a Brotli Code-Execution Bug
• PHP2Shell: Mirai Attempts and an ASLR Bypass, No Confirmed Breach
• 32 UK Government Services Offline After PHP2Shell, Minister Says