Google Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy
Google Brotli decoder has been found to contain a serious memory corruption vulnerability tracked as CVE-2026-111497. The flaw impacts Node.js, Python, Bun, Envoy and any other software that embeds the official Google Brotli implementation.
What is Brotli and why the impact is so broad
Brotli is a compression format developed by Google and now used for the majority of web traffic to reduce bandwidth and improve page-load times. Because it is part of the modern web standard, virtually every major web server, CDN and proxy relies on the same upstream decoder code. Node.js ships Brotli support natively, Python provides the brotli and brotlicffi packages, the Bun JavaScript runtime includes it by default, and the Envoy cloud-native proxy uses it when Brotli decompression is enabled.
The vulnerability is an Out-of-Bounds Write. An attacker who supplies a malicious Brotli-compressed payload can cause the decoder to write beyond allocated buffers, corrupting adjacent memory. Possible outcomes include denial of service, sensitive data leakage and, most critically, remote code execution.
Node2Shell: Imperva proves RCE on official Node.js builds
Researchers at Imperva successfully weaponized the flaw on unmodified Node.js 24.22.0 (Linux arm64). They named the technique Node2Shell. The exploit works by feeding specially crafted Brotli data to functions such as zlib.brotliDecompress. Although reliability is not 100 percent and multiple attempts may be required, the attack succeeds on a stock release without any debugging symbols or weakened mitigations.
The same payload is blocked on the patched Node.js 24.22.1 release, confirming that the fix is effective. Earlier public proofs-of-concept only worked on deliberately weakened test builds; this demonstration on production binaries significantly raises the risk profile.
Affected software and remediation guidance
- Node.js 22.x below 22.23.4, 24.x below 24.22.1, 26.x below 26.12.1
- Python brotli and brotlicffi packages (all versions)
- Bun all releases that include the built-in Brotli decoder
- Envoy any deployment with Brotli decompression filters enabled
Administrators should immediately upgrade Node.js to the fixed releases listed above and restart all processes. Python users must wait for updated brotli packages or implement temporary input-size validation. Bun and Envoy users should monitor official channels for patches and consider disabling Brotli decompression until fixes are available.
Supply-chain lessons
The incident once again illustrates how a single upstream library can expose an entire ecosystem. Similar patterns were observed with Log4Shell and the xz-utils backdoor. Organizations are advised to maintain software bill-of-materials (SBOM) records, enable automated dependency updates via tools such as Dependabot, and apply defense-in-depth controls around any decompression routines.
Related articles
Critical Code Injection Flaw in Okta Access Gateway Allows Authenticated Command Execution
Okta disclosed CVE-2026-115547, a critical code injection vulnerability in the administrative console of Okta Access Gateway. An authenticated administrator can execute arbitrary commands on the underlying system using the privileges of the gateway service account. The flaw received a CVSS 3.1 score of 9.1 and stems from insufficient input validation when processing configuration values in a specific format. Affected appliances running versions prior to 2026.10.2 must be updated, as no workaround is provided. The same disclosure day also included CVE-2026-115546 for authentication source verification and two PHP execution issues (CVE-2026-109618, CVE-2026-109619) previously seen in Palo Alto PAN-OS. Exploitation requires administrative console access and no in-the-wild attacks have been reported.
GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution
GitLab has published a critical security advisory for CVE-2026-110264, a CVSS 10.0 flaw that permits unauthenticated remote code execution on both Community and Enterprise self-hosted instances. The vulnerability has existed in the codebase since 2014 and affects every version up to the latest release prior to the October 2026 patch. Exploitation requires no credentials or special conditions, allowing attackers to run arbitrary commands, exfiltrate source code, deploy backdoors, or move laterally. The issue remained undetected through multiple code iterations, security audits, and version updates due to its hidden trigger conditions within the large, complex application. Organizations are urged to immediately verify their version, review access logs for anomalies, and apply the official fix, while temporary mitigations include network restrictions and enhanced monitoring.
Microsoft Issues Out-of-Band .NET Security Updates Fixing Brotli Buffer Overflow and Other Flaws
Microsoft has released out-of-band security updates for .NET 10, .NET 9, and .NET 8 to address multiple vulnerabilities. The patches cover two newly identified issues and complete remediation for two additional flaws that received incomplete fixes during the October 13 monthly update cycle. One critical vulnerability, CVE-2026-111497, affects the Brotli compression library and can lead to information disclosure, denial of service, or privilege escalation when processing crafted compressed data. A second issue, CVE-2026-114148, enables local privilege escalation in Linux distribution packages for ASP.NET Core due to improper ownership handling. Microsoft also reissued fixes for remote code execution vulnerabilities CVE-2026-70197 and CVE-2026-102870. Organizations are advised to apply the updates immediately, including rebuilding and redistributing applications in container or embedded environments.
Top Cybersecurity Articles October 18-24 2026: GitLab, nginx, PHP and Node.js Flaws Dominate
Security NEXT published its weekly ranking of the ten most-read articles between October 18 and October 24 2026. The list is led by a critical GitLab vulnerability that also received back-port fixes for older branches. Multiple high-severity issues in the nginx web server, including three rated critical, took second place. PHP disclosed several serious flaws with an update scheduled for October 21, while Node.js prepared a security release for the same date. Additional entries covered actively exploited Fortinet and BeyondTrust vulnerabilities, Chrome 156 fixes for 353 issues, and U.S. government guidance urging immediate patching of PHP flaws or taking systems offline.