> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Brotli RCE CVE-2026-111497 impacts Node.js, Python, Envoy and Istio - URL: https://f4n6.co.uk/security-feed/brotli-rce-cve-2026-111497-impacts-node-js-python-envoy-and-istio/ - Published: 2026-10-26T13:42:52.000Z - Updated: 2026-10-26T13:42:52.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-111497 ## 1\. Executive summary CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, rated CVSS 9.2 CRITICAL, that lets an unauthenticated attacker who can submit Brotli-compressed data to a service write past the end of the decode buffer and, per the reporting, run code in the host process. It is not in CISA KEV, but EPSS stands at 33%, so exploitation is plausible in the near term even though no confirmed in-the-wild use has been published. The flaw is in the decoder itself, so it reaches every product that bundles or links a Brotli implementation: Node.js 22.x, 24.x and 26.x, the Python Brotli and brotlicffi packages, Bun, Envoy and Istio have shipped fixes, and Microsoft .NET and PowerShell are named as affected. For EMEA financial services the exposure is concentrated in edge and service-mesh components that decompress request bodies (Envoy, Istio) and in application runtimes (Node.js, Python, Bun) behind public APIs, where a single reachable decompression path is enough. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | The affected component is third-party open-source code (Google's Brotli decoder) embedded in Node.js, Envoy, Istio and Python packages that firms consume through their software supply chain, and fixes are still rolling out across downstream projects. | Firms must track which ICT third-party components in their estate carry the flaw, obtain fixed versions from those suppliers, and record the dependency exposure in their ICT third-party register. | | NIS2 Art. 21(2)(d) | The vulnerability sits in a shared decompression library used across many suppliers and languages, so supply chain security measures must cover identifying and remediating it in both first-party and procured software. | Entities in scope must show they have supply chain security measures that detect and patch a flaw inherited through a common dependency, not only through a named vendor. | ## 3\. Technical analysis & attack chain The defect is a memory corruption bug in the Brotli decoder. Crafted Brotli-compressed input causes a write outside the bounds where the decoded data is expected, which the reporting says is sufficient for remote code execution. No authentication is required; the attacker only needs a code path where the application decompresses attacker-supplied Brotli data. Because the flaw is in the decoder rather than in any one product, every implementation library that wraps it inherits the exposure. Confirmed steps, as far as the public reporting establishes them: 1. The target runs software that decompresses Brotli data supplied by the requester. Named affected products with fixes: Node.js 22.x, 24.x and 26.x; the Python Brotli and brotlicffi packages; Bun; Envoy; Istio. Microsoft .NET and PowerShell are named as affected in SecurityWeek's coverage. 2. The attacker sends crafted Brotli-compressed data to that decompression path. No credentials are needed. 3. The decoder writes past the end of its output buffer, corrupting process memory. 4. Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image using crafted Brotli data, with no debugger and no custom build. That is a proof of concept, not a report of exploitation in the wild. Node.js released its fixes on 21 October 2026 across its three supported lines (22.x, 24.x, 26.x) as part of a ten-flaw update. The reporting does not give the exact fixed version numbers per line, so confirm them against the Node.js release notes before pinning. Patches then propagated to the Python integrations, Bun, Envoy and Istio. The bulletin states that more projects are expected to confirm impact and ship fixes over the coming months, which means the patch surface will keep growing. The vulnerability was found with AI tooling; Node.js credited Khai Tran and Sylvie Mayer of the OpenAI Codex Security team. Trail of Bits has released a tool to audit code for Brotli processing and confirm whether it is vulnerable, and some detection rules are available, though the bulletin does not name them. Naming is inconsistent across the reporting. The same flaw appears as Node2Shell, HTTPS2Shell, Brocolli2Shell and Brotlipocalypse. Treat CVE-2026-111497 as the identifier of record and expect vendor advisories under any of these names. Confidence caveats. The Imperva proof of concept is a single demonstration on one Node.js build; it establishes that code execution is achievable, not that it has been achieved against production systems. No source in this set reports confirmed exploitation of CVE-2026-111497 in the wild, and the 33% EPSS score is a forecast, not evidence of use. The list of affected downstream projects is drawn from the bulletin and SecurityWeek and will be incomplete while patches are still landing. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory every service that decompresses request bodies. Priority order: internet-facing Envoy proxies and Istio ingress/sidecars configured for Brotli decompression, then Node.js 22.x/24.x/26.x services, then Python services using the Brotli or brotlicffi packages, then Bun. Where decompression is not needed, disable Brotli request decompression at the proxy and mesh layer and reject `Content-Encoding: br` on inbound requests you do not require. - Patch Node.js to the fixed release for each supported line from the 21 October 2026 update, and upgrade Envoy, Istio, Bun and the Python Brotli packages to their fixed versions. Confirm exact version numbers from each project's release notes; the bulletin does not list them. - Run the Trail of Bits audit tool against first-party code that calls a Brotli decoder to find paths you have not inventoried. P2, within 72 hours: - Add a WAF or proxy rule that caps decompressed body size and rejects Brotli-encoded request bodies above the size your applications legitimately accept. This limits reachable decode paths while patching completes. - For .NET and PowerShell components named as affected, check the Microsoft advisory for fixed versions and apply them. - Re-scan container images and SBOMs for the vulnerable Brotli library versions and rebuild images rather than patching in place. P3, within 7 days: - Add CVE-2026-111497 to dependency scanning gates in CI so new builds cannot reintroduce a vulnerable decoder. - Track the downstream projects still to confirm impact and re-run the inventory as fixes appear. - Review logs for anomalous `Content-Encoding: br` request patterns and for decoder crashes in Node.js, Envoy and Istio processes. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe no hashes, domains, IP addresses, file paths or command lines tied to exploitation of CVE-2026-111497\. The Imperva proof of concept is described but its payload is not published in these sources. Behavioural indicators are also absent: no source gives observable authentication, process or network patterns specific to this flaw. Detection must rest on the rules in §6 and on version inventory. ## 6\. Detection The sources contain no artefacts of the threat itself: no strings, filenames, mutexes, registry keys or command lines from an exploit or payload. The only concrete facts are the CVE identifier, product names and version numbers, which are not threat artefacts. A YARA rule built from those would detect reporting about the flaw, not the flaw. Insufficient indicators to author detection rules. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497?ref=f4n6.co.uk) | 9.2 Critical | — | 33% | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all pla… | ## 7\. Sources - Risky Business, "Risky Bulletin: While everyone was looking at PHP, another RCE is wrecking what's left of the internet", https://news.risky.biz/risky-bulletin-while-everyone-was-looking-at-php-another-rce-is-wrecking-whats-left-of-the-internet/, 2026-10-26. - The Hacker News, "Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software", https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html. - The Hacker News, "Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions", https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html. - The Hacker News, "Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data", https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html. - SecurityWeek, "Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages", https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-111497 as CVSS 9.2 CRITICAL, not in CISA KEV, with EPSS at 33%. The severity is justified by the unauthenticated remote code execution path and the breadth of affected software, not by observed exploitation, which no source in this set confirms. The Imperva demonstration on Node.js 24.22.0 shows code execution is achievable on an unmodified build, and that is the strongest evidence available. Client impact depends on reachable decompression paths: firms running Envoy or Istio with Brotli request decompression on internet-facing ingress, or Node.js and Python services that accept compressed bodies from untrusted clients, carry the highest exposure. We will track downstream projects as they confirm impact and ship fixes, and we will update this advisory if confirmed in-the-wild exploitation or a CISA KEV listing appears. Clients should complete the P1 inventory and patching within 24 hours and report back on any service they cannot patch, so we can help scope compensating controls. --- [Read the original source →](https://news.risky.biz/risky-bulletin-while-everyone-was-looking-at-php-another-rce-is-wrecking-whats-left-of-the-internet/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*