Brotli Decoder Flaw Threatens Node.js and Cloud Systems

Google’s Brotli compression algorithm was introduced as an alternative to gzip to improve web performance; its adoption has spread across browsers, servers, and cloud infrastructure components.

A newly discovered memory‑corruption flaw—tracked as CVE-2026-111497—targets the Brotli decoder used by many programs that unpack Brotli‑compressed data. The bug allows crafted compressed input to overwrite past the end of a buffer, corrupting program memory and opening the door for arbitrary code execution when the attacker controls both the input stream contents and has elevated privileges within the process’ sandbox or container context where it runs.¹

The vulnerability is present in several widely deployed libraries: Node.js, Bun, Python’s Brotli and brotlicffi packages, and Envoy proxy instances configured to decompress Brotli. These systems are often part of backend services and microservices architectures, meaning the impact could reach large portions of internet traffic without direct user interaction.¹

This type of overflow arises from insufficient bounds checking during decompression—a pattern similar to Heartbleed (CVE-2014–0167) that affected OpenSSL. While exploitation requires privileged access inside the target application, the widespread embedding of Brotli decoders across diverse applications makes mitigation essential. Supply‑chain attacks like this can linger months if not detected by users or organizations.

Developers are working on updates; meanwhile system administrators should audit their environments for vulnerable versions of Node.js, Bun, Python Brotli, brotlicffi, and Envoy proxies; apply any available patches immediately; and consider tightening privilege boundaries around processes that handle compressed data. Rapid patching remains the most effective defense against this new Brotli decoder flaw.