Critical Brotli decoder flaw rated 9.2 threatens Node.js, Python, and curl

A critical vulnerability in Google's widely used Brotli compression library, tracked as CVE-2026-111497, can let an attacker crash or potentially execute code on both servers and clients that handle Brotli-compressed HTTP traffic. The flaw, first disclosed by the Node.js project on October 21 and confirmed to have much broader reach by October 23, carries a CVSS v4.0 score of 9.2, rated Critical.

Brotli is the compression format behind the br content encoding used across the modern web to shrink HTTP responses and requests. Because it is bundled or statically linked into an enormous range of software, a bug in the decoder does not stay contained to one project. Security firm Aikido, which tracked the issue as it spread across language ecosystems, found it affects the upstream Brotli C library (versions 1.0.3 through 1.2.0), the PyPI brotli and brotlicffi packages, Node.js's bundled copy, and downstream consumers including the Python HTTP clients urllib3, requests, httpx, aiohttp, and Scrapy, as well as Bun, Envoy, Istio, and builds of curl and libcurl that statically link Brotli. Apache and Nginx are not affected by default, according to Aikido's analysis.

The bug is an out-of-bounds write in the decoder (CWE-787), triggered by a malformed Brotli-compressed stream. Because decompression happens automatically whenever a client or server advertises support for br encoding, the attack works in both directions: a malicious client can target a server that decodes request bodies, and a malicious server can target a client that accepts compressed responses, without any authentication. Aikido says confirmed impacts range from memory leaks and crashes to arbitrary code execution, though no in-the-wild exploitation of the Node.js variant had been observed as of October 22.

Notably, the underlying memory-safety bug was reportedly found and silently fixed in Brotli's source code back in February, by engineers at OpenAI, without anyone flagging it as a security issue at the time — meaning the vulnerable window has existed for roughly eight months before this disclosure connected the dots.

Patches are available for some, but not all, affected projects: Node.js 22.23.4, 24.22.1, and 26.12.1; Brotli 1.2.1 (with backports to 1.0.10 and 1.1.1 on older branches); brotlicffi 1.2.1.0; Bun 1.4.4; Envoy 1.40.0, 1.39.3, 1.38.6, and 1.37.8; and Istio 1.29.9, 1.30.6, and 1.31.2. Aikido warns that as of October 23, standard vulnerability scanners including pip-audit, Dependabot, and Safety were not yet flagging the affected PyPI package versions, meaning teams relying solely on automated dependency scanning may not see an alert. Given Brotli's PyPI package alone sees roughly 82.8 million downloads a month, the practical reach of unpatched installations is likely substantial.

For teams that cannot patch immediately, Aikido recommends uninstalling Brotli or brotlicffi where they are optional dependencies, and configuring servers to reject requests carrying Content-Encoding: br. The firm cautions that simply removing br from an outgoing Accept-Encoding header is not sufficient on its own, since a still-vulnerable decoder can be triggered by any party that chooses to send a Brotli-compressed payload regardless of what was requested.