Brotli Compression Flaw Reaches Beyond Node.js to Bun, Python and Envoy

A memory-corruption flaw in Google's Brotli decoder, tracked as CVE-2026-111497, is present in many programs that unpack Brotli-compressed data. These include Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Crafted compressed data can overwrite memory past the end of a buffer, which could cause a crash, a memory leak, or the running of attacker-controlled code. Imperva researchers have shown code execution on one unpatched Node.js build. The same has not been shown on the other software, and no real-world attacks have been reported.

Fixes were first released on October 21 by Node.js and Google, with more following product by product. Each program ships its own copy of Google's decoder, so each one must update that copy on its own. A program is exposed only if it decodes Brotli data that someone else controls. In Node.js and Bun, that includes the built-in fetch() reading a Brotli-encoded response, or request-body code such as Express 5 and body-parser 2 unpacking a Brotli upload. Envoy and Istio are affected only when Brotli decompression is enabled. In Python, simply having the Brotli or brotlicffi package installed is enough for clients such as requests, urllib3, httpx and aiohttp to decode Brotli responses automatically.

A web application firewall helps only partly. Vercel added firewall rules on the day of disclosure, but said they do not cover responses that functions fetch from other servers. For that path, only updating the runtime or library closes the hole.