Brotli flaw spreads past Node.js to Python, Envoy, Istio and Bun

The Brotli bug Node.js patched on October 21 is not a Node.js bug. It sits in Google’s Brotli decoder, and Aikido Security reported on October 23 that Python packages, Envoy, Istio, Bun and bundled copies in curl carry it too. If your services fetch from other servers or accept compressed uploads, every runtime that unpacks Brotli needs a patched build.

One decoder, many products

Node.js rated CVE-2026-111497 high and fixed it in 22.23.4, 24.22.1 and 26.12.1. Its advisory explains the cause. An invalid block switch was reported as a need for more input, not as an error. So the decoder kept writing bytes into an eight-byte buffer.

Attacker-supplied Brotli data “can lead to a crash, disclosure of process memory, or remote code execution.” Node.js credits OpenAI Codex Security with the report.

The GitHub advisory for the Python packages, published October 22, puts the flaw in Google Brotli 1.0.3 through 1.2.0 “on all platforms” and scores it critical, 9.2 on CVSS v4. Fixed releases are Brotli 1.2.1, 1.1.1 and 1.0.10, and brotlicffi 1.2.1.0. PyPI shows Brotli 1.2.1 went up on October 22, almost a year after 1.2.0.

Envoy followed on October 23. Its advisory covers “Envoy deployments that have Brotli decompressor configured,” with fixes in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Aikido lists Istio 1.29.9, 1.30.6 and 1.31.2 and Bun 1.4.4 as fixed.

According to Aikido, OpenAI found the bug in February and the source was fixed then. It was not flagged as a security issue, and no release carried the fix until this week.

Why it reaches code that never mentions Brotli

Most apps never call a Brotli function themselves. A library does it for them. In Node.js, the built-in fetch() decompresses Brotli responses automatically, Aikido’s Node.js write-up says. Express 5 with body-parser 2.x inflates request bodies sent with Content-Encoding: br.

Imperva ran code through both paths against the official Node.js 24.22.0 image on Linux arm64. It took several attempts and was tested on arm64 only, and 24.22.1 rejected the same input.

Python works the same way, and we checked it on October 24. In a fresh Python 3.11 environment, requests 2.34.2, httpx 0.28.1 and aiohttp 3.14.5 each sent Accept-Encoding: gzip, deflate. After pip install brotli==1.2.0, with no code change, all three sent gzip, deflate, br, so any server they call may answer in Brotli.

Package metadata on PyPI also shows the brotli extras of urllib3 (brotli>=1.2.0) and aiohttp (Brotli>=1.2) still accept the vulnerable 1.2.0, so an old lockfile keeps it.

The Python research “didn’t pursue memory corruption or code execution in the Python extension,” Aikido says. For Node.js, no attack in the wild had been reported as of October 22. Aikido still calls it urgent, and we agree: the Brotli package gets 82.8 million downloads a month, by its count.

What to do now

• Check inside the images you ship. Run node --version and pip show brotli brotlicffi in each container and server. Imperva notes package inventories can miss bundled runtimes.
• Upgrade and rebuild. Node.js 22.23.4, 24.22.1 or 26.12.1; Brotli 1.2.1 or brotlicffi 1.2.1.0; the proxies and Bun at the versions above. Node.js 20.x, 23.x and 25.x get no fix, says Aikido.
• Block Brotli while you wait. Reject requests whose Content-Encoding includes br at the proxy or load balancer. For outbound calls, Aikido says to drop br from Accept-Encoding and refuse Brotli responses. “Changing Accept-Encoding alone is insufficient,” it warns.
• Or uninstall the Python packages. Without Brotli, our test clients fell back to gzip and deflate.

The trade-off is that a blanket block may break clients that legitimately upload compressed data, so Imperva advises testing the rule against normal traffic first. Apache and Nginx do not decode Brotli by default, Aikido says. We read that as a warning: the web server in front passes Brotli bodies on to the app unless you add the rule.

Sources

• Node.js, October 2026 security releases: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• GitHub Advisory GHSA-9v8h-qqgm-4m35, Brotli and brotlicffi: https://github.com/advisories/GHSA-9v8h-qqgm-4m35
• Envoy advisory GHSA-3wvj-j6qm-62mr: https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr
• Aikido Security, “Node2Shell evolves to HTTP2Shell”: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
• Aikido Security, Node2Shell in Node.js: https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
• Imperva, “Node2Shell: from Brotli data to remote code execution”: https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
• PyPI release history for Brotli, urllib3 and aiohttp: https://pypi.org/project/Brotli/#history