Brotli decoder memory corruption flaw affects multiple runtimes and software packages

A memory-corruption vulnerability in Google Brotli decoder affects Node.js, Bun, Python packages, and Envoy proxies, according to The Hacker News. The flaw is tracked as CVE-2026-111497. The Hacker News reported that the issue sits in programs unpacking Brotli-compressed data, including the Python Brotli and brotlicffi packages and Envoy proxies configured to decompress Brotli. [1]

The vulnerability allows crafted compressed data to overwrite memory past the end of a buffer, according to The Hacker News. This memory corruption can trigger a crash, a memory leak, or the execution of attacker-controlled code. Imperva researchers demonstrated code execution on an unpatched Node.js build, although code execution has not been demonstrated on other software, and no active real-world attacks have been reported. [1]

As FTMQ Security reported earlier, security researchers published a proof-of-concept exploit named Node2Shell that demonstrates remote code execution on Node.js using crafted Brotli data. Recommended remediation steps include upgrading Node.js to versions 22.23.4, 24.22.1, or 26.12.1. [9]