Most security bugs live in one product. CVE-2026-111497 lives in a library, and that is why it is turning into a patching chore. The flaw sits in the decoder of Brotli, the open compression format Google built. Brotli is a common way for web servers and clients to shrink HTTP traffic. Its reference C code is copied into runtimes, proxies and language packages across the industry. Each of those copies has to be fixed on its own.
The Node.js project shipped the first widely noticed fix on Wednesday, October 21, in security releases for its 26.x, 24.x and 22.x lines. By October 24, The Hacker News listed fixed versions for Bun, Envoy, Istio, the Python Brotli bindings and the cdxgen software bill-of-materials tool. Security firm Aikido reported that patches were also out for libbrotli itself and for C++ users.
What the bug is
According to the National Vulnerability Database record, the flaw is a buffer overflow in Brotli's decoder source file, c/dec/decode.c. It affects Brotli versions 1.0.3 through 1.2.0. A buffer overflow means the code writes data past the end of the memory area set aside for it. Red Hat classifies it as CWE-787, an out-of-bounds write. That is one of the more dangerous kinds of memory bug, because overwritten memory can sometimes be shaped into control of the program.
The NVD entry, which lists Google as the assigning authority (the CNA), says a remote, unauthenticated attacker could corrupt the decoder's state memory, disclose memory contents, crash the process, or potentially execute code. Upstream Brotli fixed it in versions 1.0.10, 1.1.1 and 1.2.1. The record was published October 22 and still carries the status "Awaiting Analysis," so NIST has not yet added its own assessment.
The precondition matters more than the label. An attacker gets nothing unless the target decompresses Brotli data the attacker controls. Red Hat gives the typical scenarios: an HTTP response or request marked Content-Encoding: br that software decodes automatically, or a Node.js application that passes untrusted data through its zlib module or the built-in fetch() client. A service that never inflates Brotli from strangers is not exposed through this path.
How severe is it? Depends who you ask
Severity ratings differ. Google's CVSS 4.0 score in the NVD record is 9.2, Critical. The vector says the attack works over the network with low complexity but depends on certain attack requirements being present (the "AT:P" component). The Node.js project rated its fix High. Red Hat rates the issue Important rather than Critical, with a CVSS 3.1 score of 8.1. Red Hat also notes that no public, reliable remote-code-execution proof of concept exists.
Code execution has been shown in a lab, though. The Hacker News reports that Imperva researchers ran code on an unmodified Node.js 24.22.0 build on Linux ARM64. The fixed 24.x release is 24.22.1. Imperva has not released its exploit. One demonstration on one platform does not mean every unpatched install can be taken over reliably. It does mean "only a crash bug" is the wrong way to think about this.
As for real attacks, The Hacker News reports that CISA's October 23 assessment lists exploitation as "none." No source reports any attacks in the wild.
An eight-month gap
The timeline will interest anyone who follows open-source supply chains. The Hacker News reports that the bug was found by OpenAI's Codex Security. Aikido says OpenAI found it in February. The change that closes the flaw landed in Brotli's source code on February 27, but no new Brotli release containing it shipped until October 21. According to OpenAI, as quoted by The Hacker News, it was not known at the time that the change fixed a security vulnerability. For roughly eight months, the fix sat in the source tree without a release or a CVE, so downstream projects that consume Brotli through releases had no new version to pick up.
That gap also explains the patch scramble. Once a release and a CVE existed, every project that vendors Brotli (that is, ships its own copy of the C code instead of linking to a shared system library) had to pull the fix in and cut its own release. A distribution patch to the system libbrotli package does not fix a runtime that carries its own copy.
Who has shipped fixes
According to The Hacker News, the fixed versions are:
- Node.js: 22.23.4, 24.22.1 and 26.12.1
- Bun: 1.4.4
- Envoy: 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12
- Istio: 1.31.2, 1.30.6 and 1.29.9
- Python Brotli and brotlicffi: 1.2.1 and 1.2.1.0 respectively
- cdxgen: 13.5.0 and 12.8.9
- Upstream Brotli: 1.0.10, 1.1.1 and 1.2.1 (per NVD)
The Envoy and Istio entries stand out. Envoy is a widely deployed proxy, and Istio is a service mesh built on top of it. Proxies are exactly the kind of software that decompresses traffic from parties it does not control. The Hacker News says both are affected only when Brotli decompression is enabled. Aikido's write-up points the other way for two common web servers: Apache and Nginx do not decode Brotli by default. Many sites serve Brotli-compressed responses but never decompress incoming Brotli, so they are not exposed through this path unless someone configured it.
The Node.js release that carried the Brotli fix also bundled other security work, according to the Node.js advisory: fixes for DNS and TLS hostname issues tracked as CVE-2026-105482, CVE-2026-105483 and CVE-2026-106069, plus a CA certificate update tied to the compromise of an eMudhra intermediate certificate authority. Upgrading Node.js closes all of those at once, which makes the upgrade easier to justify.
What It Means for Defenders
Who is affected. Any system running code built from Brotli 1.0.3 through 1.2.0 that decompresses Brotli input from untrusted sources. In practice that means Node.js and Bun applications that fetch remote content or inflate request bodies, Envoy and Istio deployments that decode Brotli-encoded traffic, Python services using the Brotli or brotlicffi packages on untrusted data, and build pipelines running cdxgen. Remember vendored copies: a runtime, container image or appliance may ship its own Brotli regardless of what your operating system's package manager says.
What to patch first. Prioritize internet-facing services and anything that processes content from third parties: API gateways, ingress proxies, service meshes, web scrapers, webhook receivers, and Node.js or Bun services that call out to arbitrary URLs. Move to the fixed versions listed above. For Node.js, that is 22.23.4, 24.22.1 or 26.12.1, depending on your release line. Rebuild container images rather than assuming a base-image update caught everything, and check that your dependency scanners recognize the Python packages and any bundled native modules.
If you cannot patch yet. Red Hat advises limiting the exposure of services that decompress Brotli from untrusted peers and not automatically decoding br-encoded content from untrusted sources. Aikido's guidance is simpler: where no patch exists, disable Brotli decoding until one does. Turning off Brotli for responses you send has no bearing on this bug. What matters is whether your software inflates Brotli it receives.
Inventory, then verify. The hard part of this CVE is finding every copy. Use SBOM tooling and software composition analysis to search for Brotli as a direct or transitive dependency. Ask vendors of proxies, appliances and SaaS-connected agents whether their products bundle the decoder. For contractors working through CMMC, documenting the affected assets and remediation dates in your vulnerability management records is sensible practice, and a library flaw spread across many products is the kind of finding worth tracking to closure.
Watch the threat picture. CISA's assessment, as reported by The Hacker News, lists no exploitation, and Imperva has kept its exploit private. That can change quickly once a working technique is shown to be possible. Treat this as a scheduled-but-urgent patch, not a wait-and-see item.
