CVE-2026-111497 is a buffer overflow in the Google Brotli decoder. Malformed Brotli-compressed input can write past an internal buffer. Any application that passes attacker-controlled data into an affected decoder may be exposed—including compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files. Impact ranges from crashes and memory disclosure to remote code execution. Using Brotli only to compress outbound data does not by itself establish exposure to this decoder flaw.
Node.js rates the issue High in its October 21, 2026 security releases for the 22.x, 24.x, and 26.x lines. The advisory says an invalid block switch was treated as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending bytes to an eight-byte internal buffer. An attacker who can supply Brotli data that an application decompresses with `node:zlib` can corrupt process memory. The Node.js advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security for the report, and mcollina and aduh95 for the fix.
Fixed versions (as of Patch the Planet, October 23, 2026)
| Project | Fixed versions |
|---|---|
| Node.js | 22.23.4, 24.22.1, 26.12.1 (use a supported release line) |
| Bun | 1.4.4 (includes Brotli 1.2.1) |
| Envoy | 1.40.0, 1.39.3, 1.38.6, 1.37.8 (1.36.12 also includes the fix, but 1.36 is unsupported) |
| Istio | 1.29.9, 1.30.6, 1.31.2 (1.29 is end of life; move to a supported line) |
| Google Brotli (upstream) | 1.0.10, 1.1.1, 1.2.1 (pick the fixed release for your library branch) |
Upstream Brotli versions from 1.0.3 through 1.2.0 are in the vulnerable range; update libraries and static binaries that embed those builds. Envoy’s advisory (GHSA-3wvj-j6qm-62mr) applies to deployments that configure the Brotli decompressor. Also check Electron-style apps that ship both Chromium and Node, native bindings (curl/libcurl, Python/Java wrappers), and file or font pipelines that decode Brotli.
Temporary mitigation
If you cannot patch immediately, disable Brotli decompression of untrusted data while leaving gzip, deflate, or other codecs enabled where possible:
- Reject requests with `Content-Encoding: br` before any proxy, middleware, or body parser decompresses them.
- In HTTP clients, disable automatic Brotli decompression and reject Brotli responses before decoding. Removing `br` from `Accept-Encoding` alone does not stop a server from sending it.
- On Envoy or Istio, disable Brotli decompressor filters for both request and response directions; a disabled filter can pass compressed bytes to a still-vulnerable downstream decoder.
- Pause untrusted Brotli file processing until the decoder is patched.
Turning off Brotli *response compression* on a CDN or origin does not disable request or client-side decompression. After upgrading, rebuild and redeploy images that pin old runtimes, restart every replica and worker, and verify the running binary against the vendor’s fixed release.
OpenAI’s October 23 note on securing frontier-model training describes high-compute red-teaming that surfaced open-source flaws disclosed under Patch the Planet, including this Brotli issue. For that training-isolation story, see OpenAI Tightens Isolation for Frontier Model Training. For another Node.js-facing security skill note on this site, see Qoder Adds php2shell Defense and Node.js Vulnerability Scan Skills.
We have not re-verified every patch build in our own environments. If you have operational notes on exposure or upgrades, you can reach the site owner through the contact link in the footer. Related reading: OpenAI frontier training isolation and Qoder Node.js vulnerability scan skills.