Critical Brotli Decoder Flaw Exposes Node.js and Bun to Remote Execution

A significant memory-corruption vulnerability in Google’s Brotli compression decoder has been identified, impacting a wide range of popular software environments including Node.js, Bun, and various Python packages. The flaw, tracked as CVE-2026-111497, could potentially allow attackers to achieve remote code execution (RCE) by delivering maliciously crafted compressed data.

The issue stems from how the decoder handles specific compressed streams, leading to a buffer overflow. This allows an attacker to overwrite memory beyond the intended limits, potentially destabilising the application or providing a foothold for further exploitation.

Wide Impact Across Modern Runtimes

Brotli is a generic-purpose lossless compression algorithm developed by Google and is widely utilised across the web to improve loading speeds. Because the library is integrated into numerous high-performance runtimes and proxies, the scope of the vulnerability is extensive.

Among the affected platforms is the Node.js runtime, where the flaw was originally highlighted as a vector for remote code execution. Further analysis has confirmed that other major environments are similarly at risk. These include:

• The Bun JavaScript runtime;
• The Python Brotli and brotlicffi packages;
• Envoy proxies configured to decompress Brotli-encoded traffic.

The vulnerability essentially affects any application or service that uses the vulnerable version of the Brotli library to decompress untrusted data from external sources.

Mitigation and Patching

Developers and system administrators are advised to check their software dependencies for updated versions of the Brotli library. For environments like Node.js and Bun, updates to the core runtime are typically required to address the underlying issue within the built-in compression modules.

Security researchers note that while the vulnerability is serious, exploitation requires the target system to actively decompress data provided by an attacker. For many web servers and proxies, this occurs automatically during the processing of incoming HTTP requests, making them a primary target for this type of memory-corruption attack.

Users of the Python packages Brotli and brotlicffi should verify they are running the latest releases available through the Python Package Index. Similarly, infrastructure teams using Envoy should review their deployment versions against official security advisories from the project to ensure protections are in place against CVE-2026-111497.