High-Severity Remote Code Execution Vulnerability in Brotli Decoder (CVE-2026-111497)

Executive Summary

Update (October 29th, 2026) CISA has added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation, while researchers have publicly documented reliable exploitation of the Brotli vulnerability. These developments confirm the threat has progressed beyond proof-of-concept to exploitation in the wild, raising concerns for the broad ecosystem of software and appliances that depend on vulnerable Brotli versions. Beazley Security recommends that impacted organizations prioritize identification of affected software and appliances that bundle or link vulnerable Brotli versions, apply available security updates, and monitor for signs of compromise.

Update (October 26th, 2026) The vulnerability associated with CVE-2026-111497 is not limited to Node.js. It sits in the upstream Google Brotli C library (versions 1.0.3 through 1.2.0), which many other products bundle or link, including Python packages, Microsoft .NET, Bun, Envoy Proxy, and Istio. The input paths that reach the vulnerable code are now known. Researchers have demonstrated code execution against an unmodified Node.js build, and public proof-of-concept POC code is available, though not widely exploited at the time of writing. These developments change the original reporting below regarding undisclosed trigger conditions and the absence of a public POC. The Node.js fixed versions are unchanged. Organizations that already patched Node.js should now check their other affected software. New material in each section below is marked as an update.

On October 21st, 2026, the Node.js project released security updates for its 26.x, 24.x, and 22.x release lines that fix a high-severity vulnerability in the runtime's Brotli decoder. Tracked as CVE-2026-111497, the flaw is an out-of-bounds write that Node.js states permits remote code execution (RCE) when the decoder processes crafted compressed data. All three supported release lines are affected, and Node.js states that end-of-life versions are always affected when a security release occurs.

Node.js is the JavaScript runtime behind a large share of web servers, APIs, and build tooling. Applications that decompress Brotli content from untrusted sources warrant the closest attention. Node.js has not published the exact conditions an attacker needs to trigger the flaw.

Node.js does not report exploitation in the wild, and no public proof-of-concept (PoC) is known at the time of writing. Given the breadth of Node.js deployments and the potential for code execution, Beazley Security recommends affected organizations apply available fixes as soon as possible.

Affected Systems or Products

Update (October 26th, 2026): Because the flaw sits in the upstream Brotli library, the following products are also affected.

Software that bundles its own copy of the Brotli decoder needs its own update, and an operating system package update does not fix it. As of October 26th, 2026, fixes were still pending for DuckDB, the bundled build of Apache Arrow, 7-Zip-zstd, p7zip, EDK II, and the Makefile build of woff2. Desktop applications built on Electron embed both Chromium and Node.js which will need updates as well.

A fixed browser component does not mean the embedded Node.js runtime is fixed. Brotli ports written in Java, JavaScript, C#, and Rust cannot reach the code execution condition.

Mitigations / Workarounds

Update (October 26th, 2026): The following additional measures reduce exposure until fixes are deployed:

This vulnerability can be mitigated by rejecting requests that carry Content-Encoding: br at the proxy, load balancer, or web application firewall, before any Brotili component decompresses them. In Express applications, add middleware ahead of every body parser that returns HTTP 415 for any request encoding other than identity, gzip, or deflate.

In Envoy Proxy and Istio, disable the Brotli decompressor filter for both requests and responses, or remove it until specific updates are released. Leave gzip and zstd decompressor filters in place, and protect any downstream decoder that still receives the compressed data.

In Python environments, uninstall the Brotli and brotlicffi packages. urllib3, requests, and aiohttp fall back to gzip and deflate. Remove extras such as httpx[brotli] so the next install does not reinstall the package until the package is released.

In Next.js applications, set images.unoptimized to true to stop the built-in image optimizer from fetching and decoding remote images.

For DuckDB instances, pause processing of untrusted Brotli-compressed files, such as uploaded archives, fonts, and Parquet data, in software that bundles the C decoder.

Removing br from the Accept-Encoding header does not protect outbound requests, because a malicious server can send Brotli content anyway. A web application firewall does not inspect responses that an application fetches, only the runtime or library upgrade covers that path.

Node.js has not published workarounds for this vulnerability. Upgrading to the fixed release for each supported major version is the only remediation Node.js provides, and the project states that end-of-life versions are always affected by a security release. Systems on unsupported versions need to move to a supported version as soon as possible.

If patching cannot be immediately applied, the following may help to temporarily reduce risk:

• 

  Temporarily block inbound traffic from untrusted sources to affected systems.

• 

  Prioritize updating any internet-facing services and any workloads that are externally facing.

Patches

Update (October 26th, 2026): Google released Brotli 1.0.10, 1.1.1, and 1.2.1 on October 21st, 2026.

Python users can run pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0", then raise the version constraint and regenerate lockfiles so the next build does not reinstall a vulnerable version.

Microsoft delivered the .NET, Visual Studio, and PowerShell fixes through its Security Update Guide on October 25th, 2026.

Programs that link the system Brotli library, packaged as libbrotli1, brotli, or similar, are fixed once the distribution ships a patched package and the programs restart. Rebuild any image or binary that bundles its own copy. Check build images, CI runners, serverless runtimes, and developer workstations as well as production. Software composition scanners did not reliably flag the affected Python packages at disclosure, so verify installed versions directly.

Node.js has released 26.12.1, 24.22.1, and 22.23.4 to address this vulnerability, available from the Node.js October 2026 security release announcement and the Node.js download page. Applications that bundle the runtime, such as container images, need to be rebuilt on a fixed release and their services restarted for the fix to take effect.

Technical Details

Update (October 26th, 2026): The defect sits in the Brotli decoder source (c/dec/decode.c). The decoder splits a compressed stream into blocks and switches between block types as it reads them. Before the fix, the function that decodes a block switch could not report a malformed stream as distinct from one that needed more input, and the decoder's fast path ignored its result entirely. A crafted stream that requests an impossible block switch causes the decoder to keep appending attacker-supplied bytes to a small internal buffer and write past its end. The overwrite corrupts adjacent decoder state, which can lead to a crash, memory disclosure, or code execution.

Any application that decompresses Brotli data controlled by another party can reach the flaw. Common paths include:

Outbound requests. Node.js fetch() decodes Brotli responses automatically, as do Python's urllib3, requests, and aiohttp when a Brotli package is installed.

Inbound request bodies. Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0 decode Brotli request bodies. Upgrading these frameworks does not help, because the vulnerable code sits in the decoder. A bare node:http server does not decode request bodies on its own.

Direct decoding. Calls to Node.js zlib Brotli functions, Python brotli.decompress(), and libraries that decode compressed archives, fonts, caches, or queue messages.

Node.js bundles its own copy of Brotli, so the version of the system library does not affect Node.js. Only the Node.js version matters.

The Imperva Red Team executed attacker-supplied code on the official, unmodified Node.js 24.22.0 Linux image, delivering the payload both as a fetched response and as an Express request body. Their attack required several attempts, and they have not released the exploit. Multiple PoC repositories have appeared on GitHub since October 22nd, 2026. On standard builds, they demonstrate crashes and limited memory disclosure. NVD and Node.js rate the vulnerability High, while GitHub and Microsoft rate it Critical. There are no reports of exploitation in the wild as of this update.

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that Node.js bundles as a dependency. When the decoder handles crafted input, it can write outside its intended memory region, which Node.js states permits remote code execution. The Node.js fix cherry-picks a specific upstream Brotli commit into the bundled dependency.

Node.js credits Khai Tran and Sylvie Mayer at OpenAI Codex Security for the discovery of this vulnerability. Node.js has not published the preconditions for exploitation, such as which APIs or input paths reach the vulnerable code, and no further technical detail or public PoC is available at the time of writing. Additionally, there are no reports of exploitation in-the-wild when the advisory was published.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.

Sources

• 

  NVD: CVE-2026-111497

• 

  Node.js: Wednesday, October 21, 2026 Security Releases

• 

  Google Brotli: v1.2.1 Release

• 

  GitHub Advisory: GHSA-9v8h-qqgm-4m35

• 

  Microsoft: Security Update Guide, CVE-2026-111497

• 

  Istio: ISTIO-SECURITY-2026-007

• 

  Envoy Proxy: Releases

• 

  Bun: v1.4.4 Release Notes

• 

  Imperva: Node2Shell, From Brotli Data to Remote Code Execution

• 

  OpenSourceMalware: Node2Shell Affects Python

• 

  Aikido: Python Packages Are Also Vulnerable

• 

  Patch the Planet: Brotli Vulnerability

• 

  Broccoli2Shell