If you read our Node.js October security release guide, there is a follow-up. The Brotli decoder bug fixed in Node.js is in Google's own code, so it also shows up in other software your business may run, especially Python apps.
What the CVE record says
The CVE record for CVE-2026-111497 describes a buffer overflow in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. A crafted compressed stream can corrupt memory, leak data, crash the program or potentially run code. It is scored 9.2 (critical) on CVSS 4.0, and the fixed Brotli versions are 1.0.10, 1.1.1 and 1.2.1.
What else is affected
The Hacker News, on 24 October 2026, lists these, each needing its own update because each ships its own copy of the decoder:
| Software | Fixed version |
|---|---|
| Node.js | 22.23.4, 24.22.1, 26.12.1 |
| Bun | 1.4.4 |
Python Brotli package |
1.2.1 |
Python brotlicffi package |
1.2.1.0 |
| Envoy (only if Brotli decompression is configured) | 1.40.0, 1.39.3, 1.38.6, 1.37.8 |
| Istio (only if Brotli decompression is on) | 1.31.2, 1.30.6, 1.29.9 |
You are exposed only when your software decodes Brotli data that somebody else controls. That means a response from a server you call, or a request body you accept with Content-Encoding: br. Aikido notes that Apache's standard mod_brotli does not decode Brotli, and The Hacker News says a plain Node.js HTTP server does not decode request bodies by itself.
Why Python teams should look twice
Per The Hacker News and Aikido, you do not have to import Brotli in your own code. If the Brotli or brotlicffi package is installed, common HTTP clients such as requests, httpx and aiohttp can decode Brotli responses automatically. Aikido adds that some packages, Scrapy for one, install Brotli as a dependency. Features that fetch URLs you do not control, such as webhooks, link previews and crawlers, deserve attention first.
Both sources say no in-the-wild exploitation has been reported, and The Hacker News says code execution was demonstrated only on one Node.js build. Do not wait on that, because the fix is a normal version bump.
What to do today
- Find Brotli. In each Python environment and container image, run
pip show Brotli brotlicffi, and search lockfiles for "brotli". - Upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0, then regenerate lockfiles.
- Update Bun, Envoy and Istio if you use them, and apply your operating system's security updates. Debian and Amazon Linux were shipping fixes at different times, according to The Hacker News.
- Rebuild and restart. A running process and an old container image keep the vulnerable decoder.
- Check by hand. Scanners may not flag the Python packages yet.
- If you cannot update yet, reject
brrequest bodies at your proxy and turn off Brotli decoding in HTTP clients. Changing the Accept-Encoding header alone is not enough, because a server can still send Brotli. - Ask vendors and hosts whether managed services you rely on have applied the fix.
Dependency drift like this is exactly what a maintenance routine catches. Our website maintenance guide shows how to schedule it, and if you want help auditing a Python or Node.js app, contact Susraj Tech.
Frequently asked questions
Is CVE-2026-111497 only a Node.js problem?
No. It is in Google's Brotli decoder, so other software that bundles it, including Bun and the Python packages, is affected.
Which Python versions fix it?
Brotli 1.2.1 and brotlicffi 1.2.1.0 or newer.
Sources
- CVE.org: CVE-2026-111497 record
- Node.js: October 2026 security releases
- The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- Aikido: Node2Shell evolves to HTTP2Shell, Python packages affected
Last reviewed 24 October 2026. This is general security information, not a guarantee of protection. Fixed versions may change as vendors publish updates.
