Technology
Critical Brotli decoder flaw spreads across runtimes and HTTP software
A critical out-of-bounds write in Google’s Brotli decoder affects Node.js, Python packages and other software that processes attacker-controlled compressed data. The flaw can cause crashes, memory disclosure or potentially arbitrary code execution, including through transitive dependencies used by HTTP clients. Patches are available for major runtimes and libraries, but vulnerability scanners may not yet detect the affected Python packages. Operators should update Brotli components, rebuild images and binaries, and temporarily disable or reject Brotli decoding where upgrades are unavailable.
Editorial summary · Publisher article
What matters
- The flaw is tracked as CVE-2026-111497 and carries a reported CVSS 4.0 score of 9.2.
- Python users should upgrade Brotli to 1.2.1 or brotlicffi to 1.2.1.0 or later.
- Applications can be exposed through malicious responses or Brotli-compressed inbound request bodies.
- Removing Brotli support or blocking br content reduces exposure but does not replace patching bundled decoders.
Context & caveats
- The report comes from a security vendor and says there was no known exploitation in the wild for Node.js as of October 22.
Why this made the edition
The packet supplies extensive technical detail, affected versions, attack paths, remediation guidance and a clear account of advisory-tooling gaps. It is especially useful to software operators because the vulnerability can arrive through transitive dependencies and untrusted HTTP data, though the primary source is a security vendor.
Source material