Does Your Python Or Node.js App Use An Affected Compression Component?

🔍 Read the full analysis: Does Your Python Or Node.js App Use An Affected Compression Component? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security fixes are available for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder that affects versions 1.0.3 through 1.2.0 and reaches applications through runtimes and packages including Node.js and Python’s Brotli libraries. The flaw can cause a crash or memory corruption, and Imperva reported running code in a demonstration against an unmodified Node.js build; there is no reported in-the-wild exploitation as of October 26, according to the source material’s account of CISA data.

The decoder mishandles a type of malformed compressed input, treating it as incomplete rather than invalid. According to the Node.js advisory, it can then append data beyond an eight-byte internal buffer. The resulting out-of-bounds write may corrupt memory. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on the affected application and how it processes input, memory corruption can cause a crash, expose memory contents or potentially allow code execution.

Fixes have been released for several supported products. The Brotli library is fixed in 1.0.10, 1.1.1 and 1.2.1; Node.js in 22.23.4, 24.22.1 and 26.12.1; Python’s Brotli package in 1.2.1; and brotlicffi in 1.2.1.0. The source also lists fixes for Bun 1.4.4, multiple Envoy and Istio releases, .NET 8, 9 and 10 updates, and Debian packages. These are product-specific versions: administrators should check the advisory for their exact runtime, distribution and deployment.

Updating a package on disk may not be enough for a live service. The source warns that running processes keep the old decoder until restarted. Official Node.js builds bundle their Brotli copy, so the Node.js version is the relevant fix; some Linux distributions instead link Node.js to a system library. Node.js 20, 23 and 25 are listed as receiving no fix, making migration to a supported patched release important for users of those versions.

How Brotli Reaches Applications

The flaw matters beyond teams that deliberately use Brotli as a direct dependency. Compression is often handled automatically by frameworks, runtimes and libraries, so exposure depends on whether an application processes Brotli-compressed data—not simply whether its own code imports a package named Brotli. In Node.js, built-in fetch() can decode compressed responses. Python clients such as requests with urllib3, aiohttp, httpx when installed with its Brotli extra, and Scrapy may also decode them.

That makes features such as webhooks, link previews, crawlers and URL imports worth checking, as well as services that accept compressed request bodies. The supplied source says Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0 can inflate Brotli request bodies in certain parsers. The bug is in the decoder, not Express itself, so upgrading Express alone does not address it. A basic Node.js HTTP server does not decode request bodies automatically.

The same issue can affect software that reads compressed files, including tools for archives, fonts, Parquet data and firmware. A tracker cited by the source lists more than 30 projects and packages that carry their own copy. Python’s Brotli package had about 83 million downloads in the previous month, according to pypistats.org as checked October 26. That count indicates broad use, but it does not establish how many installations are vulnerable or exposed.

From Source Fix to Public Alert

The source material dates the underlying Brotli change to February 27, 2026. Its commit message, “Detect and report invalid stream earlier,” did not identify the change as a security fix. The source reports that releases containing the fix appeared on October 21, a gap of 236 days. OpenAI said the vulnerability was not known at the time of the source change and that no newer Brotli release was available.

The CVE became public on October 22, and a public proof of concept appeared on GitHub that day, according to the cited tracker. The issue has since moved through downstream projects, with fixes appearing in language packages, runtimes and Linux distributions. The source says some Python package advisories were missing from advisory databases on October 23, which left scanners without an alert until GitHub’s advisory was added later that day.

Node.js credits OpenAI Codex Security in connection with the discovery. OpenAI said it found the flaw during red-teaming with teams of AI agents. The source also reports Imperva’s demonstration of code execution on an official Node.js image after several attempts. These are attributed findings, not evidence that attackers have exploited the issue against users.

“A bigger deal than PHP2Shell”

— Juliano Rizzo, according to broccoli2shell.com

Exposure and Unpatched Copies

The available information does not establish how many services are vulnerable, reachable by an attacker or running affected versions. A dependency may be present without being used on an exposed input path, while a bundled or system-level copy can be easy to miss in a project’s top-level dependency list. Teams need to check both their dependency tree and their runtime or operating-system build.

The source says CISA’s exploitation field lists “none” and that the CVE is not in CISA’s Known Exploited Vulnerabilities catalog. That supports the statement that exploitation was not known to those sources as of the reporting date; it does not prove that exploitation has never occurred. Nor does a demonstration on an unmodified Node.js image establish that every affected installation is remotely exploitable.

As of October 26, the cited tracker listed seven bundled copies still unfixed, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools; it said five more were fixed in their main branches. The source does not provide a complete status for every downstream project or say when the remaining fixes will ship. A separate DreamHost password-reset notice mentioned in the source gives no cause and has no reported link to Brotli.

Patch, Restart, Verify

Teams should identify whether deployed applications use an affected Brotli decoder, then apply the fix for the exact runtime, package, distribution or bundled component. For Node.js, check the version actually running, not only the version declared in a project file. Python teams should inspect installed Brotli and brotlicffi packages and the libraries that may activate compression automatically. Operators using containers should confirm that rebuilt images contain the patched component.

After updating, restart affected processes so they load the fixed decoder, then verify the running version and review deployment results. If a project bundles Brotli, its own release may lag behind the C library or main branch; monitor that project’s security notices rather than assuming an upstream fix has reached users. The next relevant development is the release of updates by the remaining affected projects and distributions, alongside any changes to exploitation reporting or official advisories.

Key Questions

What is CVE-2026-111497?

It is a flaw in Google’s Brotli C decoder that can mishandle malformed compressed input and write beyond an internal buffer. The reported effects include memory corruption, crashes and the potential for code execution.

Does an application have to use Brotli directly to be affected?

No. A runtime, framework or dependency may decode Brotli automatically, or another product may bundle the C library. Check the software and versions actually deployed, including system libraries and bundled copies.

Which Node.js and Python versions have fixes?

The source lists Node.js 22.23.4, 24.22.1 and 26.12.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. It says Node.js 20, 23 and 25 receive no fix. Check current project advisories before choosing an upgrade.

Is updating a package enough?

Not necessarily. A running process may retain the old decoder after files are updated. Restart affected services and verify that the live process uses the patched runtime or library.

Has the flaw been exploited in the wild?

The source reports no known in-the-wild exploitation as of October 26, 2026, citing CISA data that lists exploitation as “none.” It also describes a research demonstration of code execution; that is not evidence of attacks against deployed users.

Source: ThorstenMeyerAI.com