Brotli decoder CVE-2026-111497 enables RCE in Bun, Python, and Envoy

1. Executive summary

An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) has been rated CVSS 9.2, critical, and affects every program that unpacks Brotli-compressed data, including Bun, the Python Brotli and brotlicffi packages, Envoy proxies configured to decompress Brotli, and all supported Node.js release lines. Imperva demonstrated code execution on an unmodified official Node.js 24.22.0 Linux arm64 image by feeding crafted Brotli data to the bundled decoder, a proof of concept they call Node2Shell. Node.js released fixes on 21 October 2026 across its 22.x, 24.x and 26.x lines. The CVE is not in CISA KEV and EPSS sits at 1%, so there is no evidence of exploitation in the wild, but the affected components sit in request-handling paths at many EMEA financial services firms, and any service that accepts Brotli-compressed input from untrusted clients is exposed to remote, unauthenticated memory corruption.

2. Regulatory framing

No incident has occurred, so the DORA Art. 17/18/19 incident-management and reporting chain is not engaged by this item as it stands.

3. Technical analysis & attack chain

The flaw is an out-of-bounds write in the Brotli decoder at c/dec/decode.c, present in Google Brotli versions 1.0.3 through 1.2.0 on all platforms. A crafted Brotli-compressed stream causes the decoder to write past the end of a buffer, corrupting adjacent decoder state memory. The GitHub advisory states the consequences as memory disclosure, denial of service, and potentially arbitrary code execution. NVD classifies the weakness as CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write); the source describes it only as a buffer overflow, and both descriptions fit the same defect.

Confirmed steps, as demonstrated by Imperva and reported by Node.js:

1. The target runs a Brotli decoder in the affected version range (1.0.3 through 1.2.0), either directly or bundled inside a runtime. Node.js bundles the decoder, and all supported lines (22.x, 24.x, 26.x) were affected before the 21 October 2026 updates.
2. The attacker supplies a crafted Brotli-compressed stream to any path where the application decompresses attacker-controlled data. The Imperva demonstration used the bundled decoder in an official Node.js 24.22.0 image for Linux arm64.
3. The decoder writes past the end of its output buffer, corrupting adjacent decoder state memory.
4. On the demonstrated Node.js build, this corruption was turned into execution of attacker-supplied code with no debugger and no custom build. The source does not describe the exploitation primitives (heap layout, control-flow target, or bypasses) used to convert the overwrite into code execution.

The attack requires no authentication and no prior access; the only precondition is that the target decompresses Brotli data the attacker controls. Envoy proxies configured to decompress Brotli are named as affected, which places the decoder in the HTTP request path for services behind such a proxy. The Python Brotli and brotlicffi packages and Bun are also named as affected consumers.

What the sources do not establish: whether exploitation is reliable across builds and architectures beyond the demonstrated Linux arm64 Node.js image; whether the overwrite can be reached through every Brotli decompression entry point or only some; and any post-exploitation behaviour, persistence, or command-and-control, none of which is described. No in-the-wild exploitation is reported, consistent with the CVE's absence from CISA KEV and an EPSS of 1%. The Node2Shell code-execution result rests on Imperva's demonstration as reported; treat the reliability of exploitation beyond that single demonstrated build as unconfirmed.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every Brotli decoder in the estate and its version. The affected range is Google Brotli 1.0.3 through 1.2.0. Check bundled copies inside Node.js, Bun, Envoy and Python environments, not just standalone installs. For Python, run pip show brotli brotlicffi and check the reported version against the range.
• Upgrade Node.js to the fixed release for each supported line. Node.js shipped fixes for 22.x, 24.x and 26.x on 21 October 2026; the source names the lines but not the exact fixed version strings, so confirm the fixed version against the Node.js security release for each line before pinning.
• Upgrade standalone Brotli libraries and binaries to 1.0.10, 1.1.1 or 1.2.1, the versions the GitHub advisory names as fixed.
• Where an Envoy proxy decompresses Brotli on a request path reachable from untrusted clients, disable Brotli request decompression until the proxy is rebuilt against a fixed decoder.

P2 (within 72 hours)

• Rebuild container images and base images that bundle an affected runtime. The Imperva demonstration used the official Node.js 24.22.0 image, so treat official and internally maintained base images as in scope and rebuild from fixed tags.
• Update Python dependency pins for brotli and brotlicffi to fixed releases and redeploy affected services.
• Add a WAF or proxy rule rejecting Brotli-compressed request bodies on endpoints that do not require them, as a stopgap for services that cannot be patched inside 24 hours.

P3 (within 7 days)

• Add Brotli decoder version to the software bill of materials for internet-facing services and to the dependency-review gate in CI, so a future regression in the 1.0.3 to 1.2.0 range is caught at build time.
• Review which externally reachable endpoints accept compressed request bodies at all, and remove decompression where the application does not need it.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe a vulnerability and a proof-of-concept demonstration but publish no hashes, network indicators, filenames or other atomic artefacts. The only machine-usable pivot is the affected version range, which belongs in asset inventory rather than an IOC feed.

6. Detection

Insufficient indicators to author detection rules.

The sources give no distinctive strings, command-line flags, file paths, registry keys or network artefacts belonging to an exploit. The version range (Brotli 1.0.3 through 1.2.0) and the CVE identifier are properties of the affected software and of reporting about it, not artefacts of an attack, so a rule built on them would flag inventory rather than exploitation. Detection for this item is version-based: query asset and SBOM data for Brotli decoders in the 1.0.3 to 1.2.0 range and for Node.js builds predating the 21 October 2026 fixes.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News, "Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software", https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html, 2026-10-24.
• The Hacker News, "Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data", https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html, October 2026.
• The Hacker News, "Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions", https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html, October 2026.
• GitHub Security Advisories, "Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package" (GHSA-9v8h-qqgm-4m35), https://github.com/advisories/GHSA-9v8h-qqgm-4m35, October 2026.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-111497 at CVSS 9.2, critical, not in CISA KEV, EPSS 1%. The technical case for remote code execution is credible because Imperva demonstrated it on an unmodified official Node.js build, but that result is single-sourced to Imperva's demonstration as reported, and no in-the-wild exploitation is recorded, so we do not treat this as an active campaign. The client impact is broad rather than deep: any EMEA financial services firm running Node.js, Bun, Envoy with Brotli decompression, or the Python Brotli packages on an internet-facing path has an unauthenticated memory-corruption exposure until it patches, and the fix is available now. We will track the Node.js fixed version strings for each supported line and any change in KEV or EPSS status, and we will reissue this advisory if exploitation is reported or if the demonstrated exploit is shown to work beyond the Linux arm64 Node.js image. Clients should complete the P1 inventory and patching steps before the next change window.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.