Brotli fixes a critical decoder flaw that reaches far beyond Node.js

Brotli fixes a critical decoder flaw that reaches far beyond Node.js

22 October 2026: Google's Brotli compression library has a buffer overflow in its decoder, CVE-2026-111497, that lets a remote attacker who needs no login corrupt memory, read it, crash the process or possibly run code, simply by sending a crafted Brotli-compressed stream. Google rates it 9.2 (critical) under CVSS 4.0. The fixes are Brotli 1.2.1, 1.1.1 and 1.0.10, and CISA's enrichment of the record finds no exploitation so far.

Update, 28 October 2026: that has changed. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue on 27 October, which is its statement that it has evidence of exploitation, and US federal civilian agencies must apply the fix or stop using affected products by 10 November 2026. CISA describes the flaw as an unchecked return value that lets a remote attacker who needs no login corrupt decoder memory, disclose memory contents, cause a denial of service or possibly run code, and notes that it sits in an open-source component used by many different products. It marks use in ransomware campaigns as unknown. Copies of Brotli bundled inside proxies, language packages and container images should now be treated as urgent rather than routine.

Not only a Node.js problem

When Node.js shipped its October security releases, it listed the Brotli bug as its own and rated it high, which we covered in our Node.js item. The flaw sits in the shared C decoder, c/dec/decode.c, so it travels with every program that bundles or links Brotli. Jan Schaumann made that point on the oss-security list on 23 October, warning readers against thinking "I don't use Node.js, so nothing to worry about", and suggested that OpenSSL's handling of Brotli-compressed certificates could be affected too. That last point is his conjecture; no OpenSSL advisory had appeared when we read the thread.

The CVE record credits Khai Tran and Sylvie Mayer of OpenAI's Codex Security team as finders, and Envoy's advisory credits OpenAI Security Research. The record gives 27 February 2026 as its public date, nearly eight months before any tagged release carried a fix, so builds made from the source tree after that date may already include the correction while every packaged release up to 1.2.0 does not.

Fixed versions by package

Affected are Brotli 1.0.3 up to 1.2.0. The maintainers tagged all three fixed releases within a minute of each other on 21 October.

Package	Vulnerable	Fixed
Brotli C library, 1.0 line	1.0.3 to 1.0.9	1.0.10
Brotli C library, 1.1 line	1.1.0	1.1.1
Brotli C library, 1.2 line	1.2.0	1.2.1
PyPI brotli	1.0.3 to below 1.2.1	1.2.1
PyPI brotlicffi	1.0.3 to below 1.2.1.0	1.2.1.0
Envoy	1.39.2, 1.38.5, 1.37.7, 1.36.11	1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12
Debian 12 (bookworm)	1.0.9-2	1.0.9-2+deb12u1 (DLA-4855-1)
Debian 13 (trixie)	1.1.0-2	1.1.0-2+deb13u1 (DSA-6582-1)

Envoy says only deployments with the Brotli decompressor configured are exposed. Debian's tracker still lists unstable as unfixed, and notes that its own Node.js packages use the system Brotli library, so on Debian the brotli package update is the one that matters.

Where the severity ratings disagree

Google's CNA scores it critical, GitHub's advisory database calls it critical, Node.js called its bundled copy high, and Ubuntu's tracker gives it medium priority. Schaumann questioned whether operating-system vendors were treating it with enough urgency. The disagreement matters for teams that patch by distribution priority: a medium label can push a fix into the next maintenance window when the library sits in an internet-facing proxy that decompresses whatever a client sends.

Finding the copies you run

Brotli is usually a dependency of a dependency. Container images, language packages that vendor their own copy (the Python bindings, for one), reverse proxies and CDN edge software are the places to look, along with any service that accepts Content-Encoding: br from clients. A software bill of materials search for brotli and brotlicffi finds most of them; statically linked binaries need their vendor's word. Our vulnerability management software category lists 16 products that can run that kind of inventory.

Related on TrustList:

• Node.js fixes a Brotli remote code flaw and two TLS hostname bypasses
• HubSpot developer CLI needs Node.js 22 or later from 8 January 2027
• Azure Functions ends .NET 8, .NET 9 and PowerShell 7.4 support on 10 November

Sources

• CVE Program: CVE-2026-111497, Out-of-Bounds Write in Google Brotli Decoder, 22 October 2026
• google/brotli on GitHub: releases v1.2.1, v1.1.1 and v1.0.10, 21 October 2026
• GitHub Advisory Database: GHSA-9v8h-qqgm-4m35 (PyPI brotli and brotlicffi), 22 October 2026
• Envoy: GHSA-3wvj-j6qm-62mr, Out-of-Bounds Write in Brotli Decompressor, 23 October 2026
• Debian LTS: DLA-4855-1 brotli security update, 23 October 2026
• oss-security: Re: Upcoming Node.js security release 2026/10/21, 23 October 2026
• CISA: Known Exploited Vulnerabilities catalogue, entry CVE-2026-111497 (JSON feed), 27 October 2026